CVE-2020-15079

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The problem is fixed in version 1.7.6.6

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
PrestaShop	PrestaShop	>= 1.5.0.0, < 1.7.6.6

References

https://github.com/PrestaShop/PrestaShop/commit/8833d9504cc5d69a2a6d10197f56f0c11443cbfaPatch, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xp3x-3h8q-c386Third Party Advisory
https://github.com/PrestaShop/PrestaShop/commit/8833d9504cc5d69a2a6d10197f56f0c11443cbfaPatch, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xp3x-3h8q-c386Third Party Advisory

Timeline

Published: Jul 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-15087.6<p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully ex CVE-2020-150805.3In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be acc CVE-2020-150815.3In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in versio CVE-2020-150828.8In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fi CVE-2020-150836.1In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem CVE-2020-150849.1In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced CVE-2020-150856.1In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local stor CVE-2020-150869.8In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal ver CVE-2020-150878.8In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto s CVE-2020-15097.8An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service (LSASS) when an authenticated attacker send CVE-2020-150916.5TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen n CVE-2020-150924.8In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted cont