CVE-2020-5279CWE-284

Improper Access Control for certain legacy controller in PrestaShop

Medium · published April 20, 2020

CVSS v3.1
4.1
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00812 · 56.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-04-20T16:50Z
EPSS history
Timeline
  • 20 APR 16:50Z
    Improper Access Control for certain legacy controller in PrestaShop
    cvelistv5