CVE-2020-5293 MEDIUM

CVE-2020-5293: Improper access control on product page with combinations, attachments and specific prices in PrestaShop

Vendor Prestashop

Product PrestaShop

Weakness CWE-284

Published April 20, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.

Key dates

02Disclosure timeline

April 20, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-5293 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities

04Related CVE

CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2 CVE-2025-0968 ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode