GHSA-8XX5-H6M3-JR33 Presta Shop vulnerable to email enumeration

Impact An unauthenticated attacker with access to the back-office URL can manipulate the idemployee and resettoken parameters to enumerate valid back-office employee email addresses. Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of...

CVE-2020-6302

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session...

Session fixation

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session...

PT-2020-19083

Name of the Vulnerable Software and Affected Versions SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 Description The issue allows an attacker to obtain the jSession ID via methods such as shoulder surfing or man-in-the-middle attacks when the application is initially loaded. This jSession ID i...

CVE-2020-6302: Session Fixation

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session...