Lucene search

GitHub_MCVE-2020-15080

HistoryJul 02, 2020 - 5:15 p.m.

CVE-2020-15080

2020-07-0217:15:12

CWE-200

CWE-862

GitHub_M

web.nvd.nist.gov

prestashop

cve-2020-15080

vulnerability

unauthorized access

sensitive files

security

exploit

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure composer.json and docker-compose.yml are not accessible on your server.

Affected configurations

Nvd

Vulners

Node

prestashopprestashopRange1.7.4.0–1.7.6.6

VendorProductVersionCPE
prestashopprestashop*cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
prestashop	prestashop	*	cpe:2.3:a:prestashop:prestashop::::::::

CNA Affected

[
  {
    "product": "PrestaShop",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.7.4.0, <1.7.6.6"
      }
    ]
  }
]

References

github.com/PrestaShop/PrestaShop/commit/35ef7e9d892287c302df1fc5aa05ecfc6f15bc76

github.com/PrestaShop/PrestaShop/security/advisories/GHSA-492w-2pp5-xhvg

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

Related for CVE-2020-15080