CVE-2020-5293: 
Prestashop vulnerability analysis and mitigation

CVE-2020-5293 affects PrestaShop versions between 1.7.0.0 and 1.7.6.5, where improper access controls were identified on product pages specifically related to combinations, attachments, and specific prices. The vulnerability was discovered and disclosed on April 20, 2020, and has been patched in version 1.7.6.5 (GitHub Advisory).

The vulnerability stems from improper access control implementations in several controller components, including AttachementProductController.php, CombinationController.php, and SpecificPriceController.php. The issue was introduced through multiple commits (05e89ca, 7958852, 41cb141) and has been assigned a CVSS v3.1 Base Score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) (NVD).

The vulnerability could allow unauthorized access to product-related functionalities, potentially exposing sensitive product information and allowing unauthorized modifications to product combinations, attachments, and specific prices (GitHub Advisory).

The vulnerability can be exploited through network access, with low attack complexity and no user interaction required, as indicated by the CVSS metrics. No authentication is needed to exploit this vulnerability (NVD).

The recommended mitigation is to upgrade to PrestaShop version 1.7.6.5 or later, which contains the security fix. The fix includes the addition of @AdminSecurity annotations to properly control access to affected controllers (GitHub Commit).