5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-67v7-3g49-mxh2

GHSA-67v7-3g49-mxh2: PrestaShop affected by time based enumeration in FO login form

Impact

A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.

Patches

8.2.4 and 9.0.3

Workarounds

None

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-67v7-3g49-mxh2

GHSA-67v7-3g49-mxh2:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
prestashop/prestashop	composer	>= 9.0.0-alpha.1, < 9.0.3	9.0.3
prestashop/prestashop	composer	< 8.2.4	8.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a time-based user enumeration issue in PrestaShop's customer authentication. By analyzing the patches, I identified the exact commit that addresses this vulnerability. The commit c4b32c60e6a47bf86712852a96822efdc7a6d660 modifies the getByEmail function in classes/Customer.php. The changes in this function clearly show the mitigation strategy for the timing attack. Specifically, the code was altered to prevent early exit when a user is not found. Instead of returning immediately, the patched code now generates a fake password hash and a fake user result, ensuring that the function's execution time is consistent whether the user exists or not. This directly points to Customer::getByEmail as the vulnerable function, as its original implementation allowed for the timing discrepancy that could be exploited for user enumeration.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.