~ / search / GHSA-3g43-x7qr-96ph

GHSA-3g43-x7qr-96ph

Possible CSRF token fixation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25170

Packages

EcosystemPackageAffectedFixed in
Packagist prestashop/prestashop < 8.0.1 8.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables `same-site attackers` to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. ### Patches The problem is fixed in version 8.0.1

References

External links from the advisory. They lead to third-party sites.