PrestaShop affected by time based enumeration in FO login form

中 5.3CVE-2026-25597 · GHSA-67v7-3g49-mxh2 · 06/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-25597 は prestashop/prestashop, prestashop (prestashop) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.5% より高い）。
対処：9.0.3, 8.2.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
prestashop/prestashop Packagist	`≥ 9.0.0-alpha.1, < 9.0.3< 8.2.4`	`9.0.38.2.4`
prestashop prestashop	`≥ 9.0.0, < 9.0.3< 8.2.4`	`9.0.38.2.4`

概要

Impact

A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.

Patches

8.2.4 and 9.0.3

Workarounds

none

References

Found by Lam Yiu Tung

NVD の説明

PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.