Описание
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
Ссылки
- ExploitThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.7.6.9 (исключая)
cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*
EPSS
Процентиль: 76%
0.00922
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-284
NVD-CWE-noinfo
EPSS
Процентиль: 76%
0.00922
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-284
NVD-CWE-noinfo