CVE-2026-25597

MEDIUM5.3EPSS 0.06%

PrestaShop affected by time based enumeration in FO login form

發布日:2026/2/3修改日:2026/2/10

也稱為:GHSA-67v7-3g49-mxh2BIT-prestashop-2026-25597

描述

### Impact A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. ### Patches 8.2.4 and 9.0.3 ### Workarounds none ### References Found by Lam Yiu Tung

受影響套件(2)

Bitnami/prestashopfrom 0, < 8.2.4, >= 9.0.0, < 9.0.3
Packagist/prestashop/prestashop>= 9.0.0-alpha.1, < 9.0.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-25597
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2