CVE-2020-15080
Information disclosure in release archive in PrestaShop
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server.
En PrestaShop desde versión 1.7.4.0 y anteriores a versión 1.7.6.6, algunos archivos no deberían estar en el archivo de publicación, y otros no deberían ser accesibles. El problema es corregido en versión 1.7.6.6. Una posible solución alternativa es asegurarse de que "composer.json" y "docker-compose.yml" no sean accesibles en su servidor
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-06-25 CVE Reserved
- 2020-07-02 CVE Published
- 2023-03-18 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-862: Missing Authorization
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-492w-2pp5-xhvg | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/PrestaShop/PrestaShop/commit/35ef7e9d892287c302df1fc5aa05ecfc6f15bc76 | 2021-11-18 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Prestashop Search vendor "Prestashop" | Prestashop Search vendor "Prestashop" for product "Prestashop" | > 1.7.4.0 < 1.7.6.6 Search vendor "Prestashop" for product "Prestashop" and version " > 1.7.4.0 < 1.7.6.6" | - |
Affected
| ||||||