PrestaShop up to 1.7.6.4 back redirect

Summaryinfo

A vulnerability was found in PrestaShop 1.7.6.0/1.7.6.1/1.7.6.2/1.7.6.3/1.7.6.4. It has been rated as problematic. This impacts an unknown function. Performing a manipulation of the argument back as part of Credentials results in redirect. This vulnerability is cataloged as CVE-2020-5270. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in PrestaShop 1.7.6.0/1.7.6.1/1.7.6.2/1.7.6.3/1.7.6.4 (E-Commerce Management Software). This affects an unknown function. The manipulation of the argument back as part of a Credentials leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, and integrity. The summary by CVE is:

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5

The weakness was shared 04/20/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2020-5270 since 01/02/2020. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

Upgrading to version 1.7.6.5 eliminates this vulnerability.

The entries VDB-154123, VDB-154122, VDB-154121 and VDB-154120 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• PrestaShop

Version

• 1.7.6.0
• 1.7.6.1
• 1.7.6.2
• 1.7.6.3
• 1.7.6.4

License

• open-source

Website

• Product: https://github.com/PrestaShop/PrestaShop/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion