CVE-2018-13784

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://build.prestashop.com/news/prestashop-1-7-3-4-1-6-1-20-maintenance-releases/Vendor Advisory
https://github.com/PrestaShop/PrestaShop/pull/9218Third Party Advisory
https://github.com/PrestaShop/PrestaShop/pull/9222Third Party Advisory
https://www.exploit-db.com/exploits/45046/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45047/Exploit, Third Party Advisory, VDB Entry
http://build.prestashop.com/news/prestashop-1-7-3-4-1-6-1-20-maintenance-releases/Vendor Advisory
https://github.com/PrestaShop/PrestaShop/pull/9218Third Party Advisory
https://github.com/PrestaShop/PrestaShop/pull/9222Third Party Advisory
https://www.exploit-db.com/exploits/45046/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45047/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-137856.5In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and CVE-2018-137876.7Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS progra CVE-2018-137897.5An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server CVE-2018-137907.2A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local n CVE-2018-137919.8The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12 CVE-2018-137929.8Multiple SQL injection vulnerabilities in the monitoring feature in the HTTP API in ABBYY FlexiCapture before 12 Release 2 allow an attacker CVE-2018-137938.8Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 exist in Web V CVE-2018-137949.8A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.CVE-2018-137957.5Gravity before 0.5.1 does not support a maximum recursion depth.CVE-2018-137966.5An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted si CVE-2018-137979.8The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec CVE-2018-137987.5A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V14), SICAM A8000 CP-802X (All versions < V14), SICAM A8000 CP-80