CVE-2020-5250

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

• CWE-285
• CWE-552

• https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069Patch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069Patch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3Third Party Advisory

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5245Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arb…8.8
• CVE-2020-5246Traccar GPS Tracking System before version 4.9 has a LDAP in…6.5
• CVE-2020-5247In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an appl…7.5
• CVE-2020-5248GLPI before before version 9.4.6 has a vulnerability involvi…5.3
• CVE-2020-5249In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application…6.5
• CVE-2020-5251In parser-server before version 4.1.0, you can fetch all the…5.3
• CVE-2020-5252The command-line "safety" package for Python has a potential…4.1
• CVE-2020-5253NetHack before version 3.6.0 allowed malicious use of escapi…9.8
• CVE-2020-5254In NetHack before 3.6.6, some out-of-bound values for the hi…8.1
• CVE-2020-5255In Symfony before versions 4.4.7 and 5.0.7, when a `Response…4.3
• CVE-2020-5256BookStack before version 0.25.5 has a vulnerability where a …8.8