Skip to content

Possible CSRF token fixation

Moderate
matthieu-rolland published GHSA-3g43-x7qr-96ph Mar 13, 2023

Package

composer prestashop/prestashop (Composer)

Affected versions

1.7.0.0

Patched versions

8.0.1

Description

Impact

When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Patches

The problem is fixed in version 8.0.1

Severity

Moderate
5.0
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE ID

CVE-2023-25170

Weaknesses

No CWEs