Possible CSRF token fixation

高 8.8CVE-2023-25170 · GHSA-3g43-x7qr-96ph · 13/03/2023 公開 · 17/06/2026 更新

要点

CVE-2023-25170 は prestashop/prestashop, prestashop (prestashop) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.22%（全脆弱性の 12.3% より高い）。
対処：8.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
prestashop/prestashop Packagist	`< 8.0.1`	`8.0.1`
prestashop prestashop	`< 8.0.1`	`8.0.1`

概要

Impact

When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Patches

The problem is fixed in version 8.0.1

NVD の説明

PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.