CVE-2020-5288: 
Prestashop vulnerability analysis and mitigation

The vulnerability CVE-2020-5288 affects PrestaShop versions between 1.7.0.0 and 1.7.6.5, involving improper access controls on the product attributes page. The issue was discovered and disclosed in April 2020, with a fix implemented in version 1.7.6.5 (GitHub Advisory, NVD).

The vulnerability is classified as an Incorrect Authorization (CWE-863) and Improper Access Control (CWE-284) issue. According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity (NVD).

The vulnerability could potentially allow unauthorized access to product attributes functionality, compromising the confidentiality and integrity of product data. The CVSS scoring indicates potential for low-level impacts on both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability has been patched in PrestaShop version 1.7.6.5. Users are advised to upgrade to this version or later to resolve the security issue. The fix includes the implementation of proper access control annotations (@AdminSecurity) on the AttributeController (GitHub Patch).