CVE-2020-4074
Global infos:
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
CVE Status: Modified
References:
Metrics:
| Attribute | Value |
|---|---|
| Attack Complexity | HIGH |
| Attack Vector | NETWORK |
| Availability Impact | LOW |
| Base Score | 8.9 |
| Base Severity | HIGH |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Privileges Required | NONE |
| Scope | CHANGED |
| User Interaction | NONE |
| Vector String | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L |
| Exploitability Score | 2.2 |
| Impact Score | 6 |
| Source | [email protected] |
| Type | Secondary |