CVE-2020-26224

Improper Access Control in PrestaShop

State: Published
Severity: 7.5 High
Published: Nov 16, 2020
Updated: Aug 4, 2024
Reserved: Oct 1, 2020

Description

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
PrestaShopPrestaShop	>= 1.4.10.0 < 1.7.6.9Affected

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m
https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.