CVE-2020-4074

Improper Authentication

CVSS 8.9 HIGHEPSS 1.8%CWE-287

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected products

PrestaShop · PrestaShop

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/PrestaShop/PrestaShop/commit/30b6a7bdaca9cb940d3ce462906dbb062499fc30 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-ccvh-jh5x-mpg4