CVE-2020-5279 - CVE House
Back to Database
Status published Medium CVE-2020-5279

Improper Access Control for certain legacy controller in PrestaShop

Vulnerability Description

In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5279

Credits & Attribution

No credits recorded in the NVD database.

References

More from PrestaShop

View All →
CVE-2025-24027
ps_contactinfo has potential XSS due to usage of the nofilter tag in template
Medium 6.2
CVE-2024-34717
Anonymous PrestaShop customer can download other customers' invoices
Medium 5.3
CVE-2024-34716
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
Critical 9.7
CVE-2024-26129
Prestashop vulnerable to path disclosure in JavaScript variable
Medium 5.8
CVE-2024-21628
XSS can be stored in DB from "add a message form" in order detail page (FO)
Medium 5.4

Affected Vendor

Affected Software

PrestaShop
Vulnerable Versions:
>= 1.5.0.0, < 1.7.6.5

Timeline

Official Publish: April 20th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact