prestashop/prestashop · Security
Possible CSRF token fixation
- GHSA ID
- GHSA-3g43-x7qr-96ph
- CVE ID
- CVE-2023-25170
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
Patches
The problem is fixed in version 8.0.1
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)