Veracode Vulnerability DatabaseVERACODE:46918Insecure Direct Object Reference (IDOR)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%
prestashop/prestashop is vulnerable to an Insecure Direct Object Reference (IDOR). The vulnerability is due to insufficient access controls, which allows any invoice to be downloaded from the front-office in anonymous mode by supplying a random secure_key parameter in the URL.
| CPE | Name | Operator | Version |
|---|---|---|---|
| prestashop/prestashop | eq | 8.1.5 | |
| prestashop/prestashop | eq | 8.1.5 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%