Critical severity · published Jul 2, 2020
CVE-2020-4074
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prestashop · Prestashop
1.5.0.0 before 1.7.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4074
Patch
https://github.com/PrestaShop/PrestaShop/commit/30b6a7bdaca9cb940d3ce462906dbb062499fc30
Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-ccvh-jh5x-mpg4
More from Prestashop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2023-39526
PrestaShop is an open source e-commerce web application
9.8
CVE-2023-39524
PrestaShop is an open source e-commerce web application
9.8
CVE-2022-31181
Remote code execution in prestashop
9.8
CVE-2022-21686
PrestaShop is an Open Source e-commerce platform