ESLog inGet started free
Medium 6.5 CVSS 3.1 Core Published on 2020-04-20

Improper access control on product page with combinations, attachments and specific prices

CVECVE-2020-5293 GHSAGHSA-cvjj-grfv-f56w
View at the source View JSON Last modified at the source: 2026-06-17

Description

Improper access control on product page with combinations, attachments and specific prices

Impact

Improper access control on product page with combinations, attachments and specific prices.

Patches

The problem is fixed in 1.7.6.5

References

Improper Access Control - Generic (CWE-284) Introduce by these commit: 05e89cac38df96b8b4edf9dcb522c1ea094dbe38 7958852315048ed434e339ec8f3138731dbf5c67 41cb1411ca65e913b67e77b4618dcb7d8544db4c

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
Medium 6.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack vectorNetwork
ComplexityHigh
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityLow
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same component: PrestaShop core
All core advisories (94)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Core Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No
GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Core Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header Core High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

Is your shop on 1.7.x < 1.7.6.5?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected