CVE-2021-21308

Katalog CVE

CVSS 9.1 · Critical EPSS 1,9%

Kerentanan Improper Authentication pada prestashop. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee patch · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 release notes · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg advisory pihak ketiga