Critical 10.0 CVSS 2.0 Core Published on 2020-07-02

Improper Authentication

CVECVE-2020-4074 GHSAGHSA-ccvh-jh5x-mpg4

View at the source View JSON Last modified at the source: 2026-06-17

Description

Improper Authentication

The authentication system is malformed and an attacker is able to foreign request and executes admin commands

The problem is fixed in 1.7.6.6

Enable PS_COOKIE_CHECKIP configuration but it's maybe not enough.

Thanks to @komradz86 (his twitter and facebook)

Original text by NVD (NIST), public domain.

Source: security-advisories@github.com · secondary

Critical 10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

Attack vectorNetwork

ComplexityHigh

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityLow

Write to the PrestaShop core security team:

Same component: PrestaShop core

IDAdvisoryComponentSeverityAffected versionsPublishedFix

GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.