CVE-2020-5270: 
Prestashop vulnerability analysis and mitigation

CVE-2020-5270 affects PrestaShop versions between 1.7.6.0 and 1.7.6.5, involving an open redirection vulnerability when using the back parameter. The vulnerability was discovered and disclosed on April 20, 2020, and has been patched in version 1.7.6.5 (GitHub Advisory, NVD).

The vulnerability is classified as an open redirect (CWE-601) with a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The issue stems from insufficient validation of the back parameter in PrestaShop's redirection mechanism, which could allow unauthorized redirection to arbitrary URLs (NVD).

The vulnerability's impact ranges from theft of information and credentials to redirection to malicious websites containing attacker-controlled content. In some cases, it could even facilitate cross-site scripting (XSS) attacks. While open redirection might initially appear harmless, the potential consequences can be severe if exploited (GitHub Advisory).

The vulnerability requires user interaction and can be exploited remotely without authentication. After the patch, the open redirection functionality remains active but requires user authentication, as it is used by modules in the back office (GitHub Advisory).

The vulnerability has been fixed in PrestaShop version 1.7.6.5. Users are advised to upgrade to this version or later. The patch maintains the redirection functionality but adds authentication requirements to prevent unauthorized exploitation (GitHub Advisory).