CVE-2020-5279

In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5

• CWE-284
• CWE-863

• https://github.com/PrestaShop/PrestaShop/commit/4444fb85761667a2206874a3112ccc77f657d76aPatch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-74vp-ww64-w2gmPatch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/commit/4444fb85761667a2206874a3112ccc77f657d76aPatch, Third Party Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-74vp-ww64-w2gmPatch, Third Party Advisory

Published

Apr 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5273In PrestaShop module ps_linklist versions before 3.1.0, ther…5.4
• CVE-2020-5274In Symfony before versions 5.0.5 and 4.4.5, some properties …5.4
• CVE-2020-5275In symfony/security-http before versions 4.4.7 and 5.0.7, wh…8.1
• CVE-2020-5276In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is…6.1
• CVE-2020-5277PrestaShop module ps_facetedsearch versions before 3.5.0 has…5.4
• CVE-2020-5278In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is…6.1
• CVE-2020-5280http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a lo…7.5
• CVE-2020-5281In Perun before version 3.9.1, VO or group manager can modif…7.5
• CVE-2020-5282In Nick Chan Bot before version 1.0.0-beta there is a vulner…9.8
• CVE-2020-5283ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerabil…3.5
• CVE-2020-5284Next.js versions before 9.3.2 have a directory traversal vul…4.3
• CVE-2020-5285In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is…6.1