Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2020-15080

Information disclosure in release archive in PrestaShop

Description

In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PrestaShop PrestaShop

  • >= 1.7.4.0, <1.7.6.6affected

References