CVE-2020-5270

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5

• CWE-601
• CWE-601

• https://github.com/PrestaShop/PrestaShop/commit/cd2219dca49965ae8421bb5a53fc301f3f23c458Patch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-375w-q56h-h7qcPatch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/commit/cd2219dca49965ae8421bb5a53fc301f3f23c458Patch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-375w-q56h-h7qcPatch, Third Party Advisory

Published

Apr 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5264In PrestaShop before version 1.7.6.5, there is a reflected X…6.1
• CVE-2020-5265In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5266In the ps_link module for PrestaShop before version 3.1.0, t…5.4
• CVE-2020-5267In ActionView before versions 6.0.2.2 and 5.2.4.2, there is …4.8
• CVE-2020-5268In Saml2 Authentication Services for ASP.NET versions before…7.3
• CVE-2020-5269In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5271In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is…6.1
• CVE-2020-5272In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is…6.1
• CVE-2020-5273In PrestaShop module ps_linklist versions before 3.1.0, ther…5.4
• CVE-2020-5274In Symfony before versions 5.0.5 and 4.4.5, some properties …5.4
• CVE-2020-5275In symfony/security-http before versions 4.4.7 and 5.0.7, wh…8.1
• CVE-2020-5276In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is…6.1