Vulnerability in Prestashop
CVE-2018-13784
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.165 (96.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.167 · newest: 0.165 · change: -0.002
Affected products
Public proof-of-concept exploits
References
- www.exploit-db.com/exploits/45046/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- github.com/PrestaShop/PrestaShop/pull/9222 (Third Party Advisory)
- build.prestashop.com/news/prestashop-1-7-3-4-1-6-1-20-maintenance-releases/ (Vendor Advisory)
- github.com/PrestaShop/PrestaShop/pull/9218 (Third Party Advisory)
- www.exploit-db.com/exploits/45047/ (Exploit, VDB Entry, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2018-13784?
- CVE-2018-13784 is a critical-severity vulnerability in Prestashop. CVSS score: 9.1/10. Published 2018-07-09.
- How severe is CVE-2018-13784?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2018-13784 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.