Lucene search

GitHub_MCVE-2020-26248

HistoryDec 03, 2020 - 9:15 p.m.

CVE-2020-26248

2020-12-0321:15:11

CWE-89

GitHub_M

web.nvd.nist.gov

113

prestashop

productcomments

module

4.2.1

blind sql injection

vulnerability

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

8.2

Confidence

High

EPSS

0.019

Percentile

88.5%

JSON

In the PrestaShop module “productcomments” before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.

Affected configurations

Nvd

Vulners

Node

prestashopproductcommentsRange<4.2.1prestashop

VendorProductVersionCPE
prestashopproductcomments*cpe:2.3:a:prestashop:productcomments:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
prestashop	productcomments	*	cpe:2.3:a:prestashop:productcomments::::::prestashop::*

CNA Affected

[
  {
    "product": "productcomments",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.2.1"
      }
    ]
  }
]