GHSA-67v7-3g49-mxh2
PrestaShop affected by time based enumeration in FO login form
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/prestashop | >= 9.0.0-alpha.1, < 9.0.3 | 9.0.3 |
| Packagist | prestashop/prestashop | < 8.2.4 | 8.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.
### Patches
8.2.4 and 9.0.3
### Workarounds
none
### References
Found by Lam Yiu Tung
References
External links from the advisory. They lead to third-party sites.