CVE-2021-21308

Improper session management for soft logout

CVSS 6.1 MEDIUMEPSS 1.0%CWE-287

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

PrestaShop · PrestaShop

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg