Description

In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.

Remediation

References

CVE-2019-13461

Related Vulnerabilities

PHP Other Vulnerability (CVE-2004-0958)

MySQL CVE-2018-3278 Vulnerability (CVE-2018-3278)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9479)

Oracle Application Server Other Vulnerability (CVE-2002-0843)

MySQL CVE-2021-2299 Vulnerability (CVE-2021-2299)

Severity

High

Classification

CVE-2019-13461 CWE-639 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities