Vulnerabilities > CVE-2019-13461 - Authorization Bypass Through User-Controlled Key vulnerability in Prestashop

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

prestashop

CWE-639

NVD

Published: 2019-07-09

Updated: 2020-08-24

Summary

In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.

Vulnerable Configurations

Part	Description	Count
Application	Prestashop Prestashop Prestashop 1.7.6.0 Prestashop Prestashop - Prestashop Prestashop 0.8.1 Prestashop Prestashop 0.8.2 Prestashop Prestashop 0.8.3 Prestashop Prestashop 0.8.4 Prestashop Prestashop 0.8.5 Prestashop Prestashop 0.8.5.1 Prestashop Prestashop 0.9 Prestashop Prestashop 0.9.1 Prestashop Prestashop 0.9.2 Prestashop Prestashop 0.9.5 Prestashop Prestashop 0.9.6 Prestashop Prestashop 0.9.7 Prestashop Prestashop 1.0 Prestashop Prestashop 1.0.0.1 Prestashop Prestashop 1.0.0.2 Prestashop Prestashop 1.0.0.3 Prestashop Prestashop 1.0.0.4 Prestashop Prestashop 1.0.0.5 Prestashop Prestashop 1.1.0.3 Prestashop Prestashop 1.4 Prestashop Prestashop 1.4.0.1 Prestashop Prestashop 1.4.0.2 Prestashop Prestashop 1.4.0.3 Prestashop Prestashop 1.4.0.4 Prestashop Prestashop 1.4.0.5 Prestashop Prestashop 1.4.0.6 Prestashop Prestashop 1.4.0.7 Prestashop Prestashop 1.4.0.8 Prestashop Prestashop 1.4.0.9 Prestashop Prestashop 1.4.0.10 Prestashop Prestashop 1.4.0.11 Prestashop Prestashop 1.4.0.12 Prestashop Prestashop 1.4.0.13 Prestashop Prestashop 1.4.0.14 Prestashop Prestashop 1.4.0.15 Prestashop Prestashop 1.4.0.16 Prestashop Prestashop 1.4.0.17 Prestashop Prestashop 1.4.1.0 Prestashop Prestashop 1.4.2.4 Prestashop Prestashop 1.4.2.5 Prestashop Prestashop 1.4.3.0 Prestashop Prestashop 1.4.4.0 Prestashop Prestashop 1.4.4.1 Prestashop Prestashop 1.4.5.1 Prestashop Prestashop 1.4.6.1 Prestashop Prestashop 1.4.6.2 Prestashop Prestashop 1.4.7.0 Prestashop Prestashop 1.4.7.1 Prestashop Prestashop 1.4.7.2 Prestashop Prestashop 1.4.8.0 Prestashop Prestashop 1.4.8.1 Prestashop Prestashop 1.4.8.2 Prestashop Prestashop 1.4.8.3 Prestashop Prestashop 1.4.9.0 Prestashop Prestashop 1.4.10.0 Prestashop Prestashop 1.4.11 Prestashop Prestashop 1.4.11.1 Prestashop Prestashop 1.5.0.0 Prestashop Prestashop 1.5.0.1 Prestashop Prestashop 1.5.0.2 Prestashop Prestashop 1.5.0.3 Prestashop Prestashop 1.5.0.5 Prestashop Prestashop 1.5.0.9 Prestashop Prestashop 1.5.0.13 Prestashop Prestashop 1.5.0.15 Prestashop Prestashop 1.5.0.17 Prestashop Prestashop 1.5.1.0 Prestashop Prestashop 1.5.2.0 Prestashop Prestashop 1.5.3.0 Prestashop Prestashop 1.5.3.1 Prestashop Prestashop 1.5.4.0 Prestashop Prestashop 1.5.4.1 Prestashop Prestashop 1.5.5.0 Prestashop Prestashop 1.5.6.0 Prestashop Prestashop 1.5.6.1 Prestashop Prestashop 1.5.6.2 Prestashop Prestashop 1.6 Prestashop Prestashop 1.6.0.0 Prestashop Prestashop 1.6.0.1 Prestashop Prestashop 1.6.0.2 Prestashop Prestashop 1.6.0.3 Prestashop Prestashop 1.6.0.4 Prestashop Prestashop 1.6.0.5 Prestashop Prestashop 1.6.0.6 Prestashop Prestashop 1.6.0.7 Prestashop Prestashop 1.6.0.8 Prestashop Prestashop 1.6.0.9 Prestashop Prestashop 1.6.0.10 Prestashop Prestashop 1.6.0.11 Prestashop Prestashop 1.6.0.12 Prestashop Prestashop 1.6.0.13 Prestashop Prestashop 1.6.0.14 Prestashop Prestashop 1.6.1.0 Prestashop Prestashop 1.6.1.1 Prestashop Prestashop 1.6.1.2 Prestashop Prestashop 1.6.1.3 Prestashop Prestashop 1.6.1.4 Prestashop Prestashop 1.6.1.5 Prestashop Prestashop 1.6.1.6 Prestashop Prestashop 1.6.1.7 Prestashop Prestashop 1.6.1.8 Prestashop Prestashop 1.6.1.9 Prestashop Prestashop 1.6.1.10 Prestashop Prestashop 1.6.1.11 Prestashop Prestashop 1.6.1.12 Prestashop Prestashop 1.6.1.13 Prestashop Prestashop 1.6.1.14 Prestashop Prestashop 1.6.1.15 Prestashop Prestashop 1.6.1.16 Prestashop Prestashop 1.6.1.17 Prestashop Prestashop 1.6.1.18 Prestashop Prestashop 1.6.1.19 Prestashop Prestashop 1.6.1.20 Prestashop Prestashop 1.6.1.21 Prestashop Prestashop 1.6.1.22 Prestashop Prestashop 1.6.1.23 Prestashop Prestashop 1.6.1.24 Prestashop Prestashop 1.7 Prestashop Prestashop 1.7.0.0 Prestashop Prestashop 1.7.0.1 Prestashop Prestashop 1.7.0.2 Prestashop Prestashop 1.7.0.3 Prestashop Prestashop 1.7.0.4 Prestashop Prestashop 1.7.0.5 Prestashop Prestashop 1.7.0.6 Prestashop Prestashop 1.7.1.0 Prestashop Prestashop 1.7.1.1 Prestashop Prestashop 1.7.1.2 Prestashop Prestashop 1.7.2.0 Prestashop Prestashop 1.7.2.1 Prestashop Prestashop 1.7.2.2 Prestashop Prestashop 1.7.2.3 Prestashop Prestashop 1.7.2.4 Prestashop Prestashop 1.7.2.5 Prestashop Prestashop 1.7.3.0 Prestashop Prestashop 1.7.3.1 Prestashop Prestashop 1.7.3.2 Prestashop Prestashop 1.7.3.3 Prestashop Prestashop 1.7.3.4 Prestashop Prestashop 1.7.4.0 Prestashop Prestashop 1.7.4.1 Prestashop Prestashop 1.7.4.2 Prestashop Prestashop 1.7.4.3 Prestashop Prestashop 1.7.4.4 Prestashop Prestashop 1.7.5.0 Prestashop Prestashop 1.7.5.1 Prestashop Prestashop 1.7.5.2	171

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References