Medium severity · published Apr 20, 2020
CVE-2020-5293
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prestashop · Prestashop
after 1.7.0.0 before 1.7.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5293
Patch
https://github.com/PrestaShop/PrestaShop/commit/f9f442c87755908e23a6bcba8c443cdea1d78a7f
Patch
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-cvjj-grfv-f56w
More from Prestashop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2023-39526
PrestaShop is an open source e-commerce web application
9.8
CVE-2023-39524
PrestaShop is an open source e-commerce web application
9.8
CVE-2022-31181
Remote code execution in prestashop
9.8
CVE-2022-21686
PrestaShop is an Open Source e-commerce platform