CVE-2020-5250
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-5250
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5250.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-5250
- Related
- Published
- 2020-03-05T17:15:11.797Z
- Modified
- 2025-11-14T09:07:23.992966Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the idaddress in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the idcustomer and change all information of all accounts. The problem is patched in version 1.7.6.4.
- References
Affected packages
Git / github.com/prestashop/prestashop
Affected ranges
- Type
- GIT
- Repo
- https://github.com/prestashop/prestashop
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.5.3.0
1.5.4.1
1.5.6.0
1.5.6.1
1.5.6.2
1.6.0.1
1.6.0.11
1.6.0.12
1.6.0.13
1.6.0.14
1.6.0.2
1.6.0.3
1.6.0.4
1.6.0.5
1.6.0.6
1.6.0.7
1.6.0.8
1.6.0.9
1.6.1.0
1.6.1.1
1.6.1.2-RC3
1.7.0.0
1.7.0.0-beta.1.0
1.7.0.0-beta.2.0
1.7.0.0-beta.3.0
1.7.0.0-beta.4.0
1.7.0.0-rc.0.0
1.7.0.1
1.7.0.2
1.7.0.3
1.7.0.4
1.7.0.5
1.7.0.6
1.7.1.0
1.7.1.1
1.7.1.2
1.7.2.0
1.7.2.0-rc.1.0
1.7.2.1
1.7.2.2
1.7.2.3
1.7.2.4
1.7.3.0
1.7.3.1
1.7.3.2
1.7.3.3
1.7.3.4
1.7.4.0
1.7.4.1
1.7.4.2
1.7.4.3
1.7.5.0
1.7.5.0-rc.1
1.7.5.1
1.7.6.0
1.7.6.0-beta.1
1.7.6.0-rc.1
1.7.6.0-rc.2
1.7.6.1
1.7.6.2
1.7.6.3