CVE-2020-5250

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-285CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-52515.3In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use CVE-2020-52524.1The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code CVE-2020-52539.8NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be eCVE-2020-52548.1In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.CVE-2020-52554.3In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can falCVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow thCVE-2020-52578.1In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated beforeCVE-2020-52587.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abilCVE-2020-52598.6In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abilitCVE-2020-52607.5Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attackeCVE-2020-52616.8Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implCVE-2020-52625.5In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new
CVE-2020-5250: Medium severity, CVSS 6.3 | Vulnix