CVE-2020-26224
Last modified
CVE-2020-26224 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.. EPSS estimates a 1.74% chance of exploitation in the next 30 days.
Description
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Prestashop | Prestashop | < 1.7.6.9 |
References
- https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909Exploit, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9mThird Party Advisory
- https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909Exploit, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9mThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-26224?
How severe is CVE-2020-26224?
How do I fix CVE-2020-26224?
Are you affected by CVE-2020-26224?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST