CVE-2020-5250

2020-03-0517:15:11

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.0%

JSON

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else’s address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

CPENameOperatorVersion
prestashopeq1.6.0.6
prestashopeq1.6.0.4
prestashopeq1.7.2.4
prestashopeq1.6.0.9
prestashopeq1.5.3.0
prestashopeq1.7.0.0-beta.4.0
prestashopeq1.7.2.1
prestashopeq1.5.6.1
prestashopeq1.7.2.0
prestashopeq1.7.2.2

Name	Operator	Version
prestashop	eq	1.6.0.6
prestashop	eq	1.6.0.4
prestashop	eq	1.7.2.4
prestashop	eq	1.6.0.9
prestashop	eq	1.5.3.0
prestashop	eq	1.7.0.0-beta.4.0
prestashop	eq	1.7.2.1
prestashop	eq	1.5.6.1
prestashop	eq	1.7.2.0
prestashop	eq	1.7.2.2