CVE-2020-5288

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284CWE-863

Affected software

VendorProductVersions
PrestaShopPrestaShop>= 1.7.0.0, < 1.7.6.5

References

Timeline

Published
Apr 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-52896.5In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming CVE-2020-52906.5In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a requCVE-2020-52917.8Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap -CVE-2020-52928.8Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute aCVE-2020-52936.5In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and spCVE-2020-52945.4PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0CVE-2020-52954.9In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to reaCVE-2020-52964.9In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delCVE-2020-52972.7In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to uplCVE-2020-52984.8In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functioCVE-2020-52995.1In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data thaCVE-2020-53005.3In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client au
CVE-2020-5288: Medium severity, CVSS 6.5 | Vulnix