by Kastro
Paper/Archive/CVE-2021-21308

CVE-2021-21308

PrestaShop PrestaShop — Improper session management for soft logout

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 79.2.792 × 2015.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2

Affected

ProductAffectedFixed inSource
PrestaShop>= 1.5.0, < 1.7.7.2–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

refgithub.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2refgithub.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcgrefgithub.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee