CVE-2023-25170
Possible CSRF token fixation
概要
Possible CSRF token fixation
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
Patches
The problem is fixed in version 8.0.1
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Packagist
prestashop/prestashop
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com