CVEvulnerability
CVE-2021-21308
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-02-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-287
Description
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
Affected configurations
• prestashop prestashop (> 1.5.0.0 < 1.7.7.2)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee Patch, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 Release Notes, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee Patch, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 Release Notes, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg Third Party Advisory