CVE-2023-25170

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
PrestaShop	PrestaShop	>= 1.7.0.0, < 8.0.1

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3g43-x7qr-96phVendor Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3g43-x7qr-96phVendor Advisory

Timeline

Published: Mar 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-251715.9Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt den CVE-2023-251725.4Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `te CVE-2023-251737.8containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups CVE-2023-251747.8Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potential CVE-2023-251755.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information d CVE-2023-251765.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2023-251777.8Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacke CVE-2023-251789.8Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommend CVE-2023-251795.5Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentia CVE-2023-25186.1The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page wh CVE-2023-251819.8A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted CVE-2023-251827.8Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to p