CVE-2020-26224: Improper Access Control in PrestaShop
Published Nov 16, 2020
·Updated
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
Affected Software
1 affected component
Prestashop PrestaShop<1.7.6.9
Event History
Nov 16, 2020
CVE Published
via MITRE·09:25 PM
Data Sourced
via MITRE·09:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-26224.
2
What is the severity of CVE-2020-26224?
The severity of CVE-2020-26224 is high with a severity value of 7.5.
3
How does CVE-2020-26224 affect PrestaShop?
CVE-2020-26224 allows an attacker to list all orders on a PrestaShop website without being logged.
4
Which version of PrestaShop is affected by CVE-2020-26224?
PrestaShop versions up to and excluding 1.7.6.9 are affected by CVE-2020-26224.
5
How can I fix CVE-2020-26224?
Update PrestaShop to version 1.7.6.9 or newer to fix CVE-2020-26224.