Insecure session management In prestashop/prestashop
Description
Possible CSRF token fixation
Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
Patches
The problem is fixed in version 8.0.1
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 8.0.1 |
Aliases
1. 2. 3. 4. 5.
References
1.