-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/prestashop | composer | < 8.2.3 | 8.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability allows an unauthenticated attacker to enumerate valid back-office employee email addresses by manipulating the id_employee parameter in the password reset functionality. The provided patch in controllers/admin/AdminLoginController.php clearly shows the vulnerable logic within the initContent function. Previously, the code would load an employee object based on the id_employee from the request and, if the employee existed, it would expose the employee's email address in the template. This allowed an attacker to cycle through potential employee IDs to harvest email addresses. The fix introduces a check to ensure that a valid reset_token is also provided and matches the one associated with the id_employee before the email is disclosed. Therefore, the AdminLoginController.initContent function is the specific location of the vulnerability, as it contains the logic that was exploited for email enumeration.
A Semantic Attack on Google Gemini - Read the Latest Research