Vulnerabilities > CVE-2019-13461 - Authorization Bypass Through User-Controlled Key vulnerability in Prestashop

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

prestashop

CWE-639

NVD

Published: 2019-07-09

Updated: 2020-08-24

Summary

In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.

Vulnerable Configurations

Part	Description	Count
Application	Prestashop Prestashop Prestashop - Prestashop Prestashop 0.8.1 Prestashop Prestashop 0.8.2 Prestashop Prestashop 0.8.3 Prestashop Prestashop 0.8.4 Prestashop Prestashop 0.8.5 Prestashop Prestashop 0.8.5.1 Prestashop Prestashop 0.9 Prestashop Prestashop 0.9.1 Prestashop Prestashop 0.9.2 Prestashop Prestashop 0.9.5 Prestashop Prestashop 0.9.6 Prestashop Prestashop 0.9.7 Prestashop Prestashop 1.0 Prestashop Prestashop 1.0.0.1 Prestashop Prestashop 1.0.0.2 Prestashop Prestashop 1.0.0.3 Prestashop Prestashop 1.0.0.4 Prestashop Prestashop 1.0.0.5 Prestashop Prestashop 1.1.0.3 Prestashop Prestashop 1.4 Prestashop Prestashop 1.4.0.1 Prestashop Prestashop 1.4.0.2 Prestashop Prestashop 1.4.0.3 Prestashop Prestashop 1.4.0.4 Prestashop Prestashop 1.4.0.5 Prestashop Prestashop 1.4.0.6 Prestashop Prestashop 1.4.0.7 Prestashop Prestashop 1.4.0.8 Prestashop Prestashop 1.4.0.9 Prestashop Prestashop 1.4.0.10 Prestashop Prestashop 1.4.0.11 Prestashop Prestashop 1.4.0.12 Prestashop Prestashop 1.4.0.13 Prestashop Prestashop 1.4.0.14 Prestashop Prestashop 1.4.0.15 Prestashop Prestashop 1.4.0.16 Prestashop Prestashop 1.4.0.17 Prestashop Prestashop 1.4.1.0 Prestashop Prestashop 1.4.2.4 Prestashop Prestashop 1.4.2.5 Prestashop Prestashop 1.4.3.0 Prestashop Prestashop 1.4.4.0 Prestashop Prestashop 1.4.4.1 Prestashop Prestashop 1.4.5.1 Prestashop Prestashop 1.4.6.1 Prestashop Prestashop 1.4.6.2 Prestashop Prestashop 1.4.7.0 Prestashop Prestashop 1.4.7.1 Prestashop Prestashop 1.4.7.2 Prestashop Prestashop 1.4.8.0 Prestashop Prestashop 1.4.8.1 Prestashop Prestashop 1.4.8.2 Prestashop Prestashop 1.4.8.3 Prestashop Prestashop 1.4.9.0 Prestashop Prestashop 1.4.10.0 Prestashop Prestashop 1.4.11 Prestashop Prestashop 1.4.11.1 Prestashop Prestashop 1.5.0.0 Prestashop Prestashop 1.5.0.1 Prestashop Prestashop 1.5.0.2 Prestashop Prestashop 1.5.0.3 Prestashop Prestashop 1.5.0.5 Prestashop Prestashop 1.5.0.9 Prestashop Prestashop 1.5.0.13 Prestashop Prestashop 1.5.0.15 Prestashop Prestashop 1.5.0.17 Prestashop Prestashop 1.5.1.0 Prestashop Prestashop 1.5.2.0 Prestashop Prestashop 1.5.3.0 Prestashop Prestashop 1.5.3.1 Prestashop Prestashop 1.5.4.0 Prestashop Prestashop 1.5.4.1 Prestashop Prestashop 1.5.5.0 Prestashop Prestashop 1.5.6.0 Prestashop Prestashop 1.5.6.1 Prestashop Prestashop 1.5.6.2 Prestashop Prestashop 1.6.0.0 Prestashop Prestashop 1.6.0.1 Prestashop Prestashop 1.6.0.2 Prestashop Prestashop 1.6.0.3 Prestashop Prestashop 1.6.0.4 Prestashop Prestashop 1.6.0.5 Prestashop Prestashop 1.6.0.6 Prestashop Prestashop 1.6.0.7 Prestashop Prestashop 1.6.0.8 Prestashop Prestashop 1.6.0.9 Prestashop Prestashop 1.6.0.10 Prestashop Prestashop 1.6.0.11 Prestashop Prestashop 1.6.0.12 Prestashop Prestashop 1.6.0.13 Prestashop Prestashop 1.6.0.14 Prestashop Prestashop 1.6.1.0 Prestashop Prestashop 1.6.1.1 Prestashop Prestashop 1.6.1.2 Prestashop Prestashop 1.6.1.3 Prestashop Prestashop 1.6.1.4 Prestashop Prestashop 1.6.1.5 Prestashop Prestashop 1.6.1.6 Prestashop Prestashop 1.6.1.7 Prestashop Prestashop 1.6.1.8 Prestashop Prestashop 1.6.1.9 Prestashop Prestashop 1.6.1.10 Prestashop Prestashop 1.6.1.11 Prestashop Prestashop 1.6.1.12 Prestashop Prestashop 1.6.1.13 Prestashop Prestashop 1.6.1.14 Prestashop Prestashop 1.6.1.15 Prestashop Prestashop 1.6.1.16 Prestashop Prestashop 1.6.1.17 Prestashop Prestashop 1.6.1.18 Prestashop Prestashop 1.6.1.19 Prestashop Prestashop 1.6.1.20 Prestashop Prestashop 1.6.1.21 Prestashop Prestashop 1.6.1.22 Prestashop Prestashop 1.6.1.23 Prestashop Prestashop 1.6.1.24 Prestashop Prestashop 1.7.0.0 Prestashop Prestashop 1.7.0.1 Prestashop Prestashop 1.7.0.2 Prestashop Prestashop 1.7.0.3 Prestashop Prestashop 1.7.0.4 Prestashop Prestashop 1.7.0.5 Prestashop Prestashop 1.7.0.6 Prestashop Prestashop 1.7.1.0 Prestashop Prestashop 1.7.1.1 Prestashop Prestashop 1.7.1.2 Prestashop Prestashop 1.7.2.0 Prestashop Prestashop 1.7.2.1 Prestashop Prestashop 1.7.2.2 Prestashop Prestashop 1.7.2.3 Prestashop Prestashop 1.7.2.4 Prestashop Prestashop 1.7.2.5 Prestashop Prestashop 1.7.3.0 Prestashop Prestashop 1.7.3.1 Prestashop Prestashop 1.7.3.2 Prestashop Prestashop 1.7.3.3 Prestashop Prestashop 1.7.3.4 Prestashop Prestashop 1.7.4.0 Prestashop Prestashop 1.7.4.1 Prestashop Prestashop 1.7.4.2 Prestashop Prestashop 1.7.4.3 Prestashop Prestashop 1.7.4.4 Prestashop Prestashop 1.7.5.0 Prestashop Prestashop 1.7.5.1 Prestashop Prestashop 1.7.5.2 Prestashop Prestashop 1.7.6.0	169

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References