Prestashop: Security vulnerability - Possible information steal

[michaelKaefer]

You tell us about the security vulnerability and possible information steal here: https://build.prestashop.com/news/prestashop-1-7-6-4-maintenance-release/?utm_source=emailing&utm_medium=email&utm_campaign=B2BEN&utm_content=Launch1764&spMailingID=17046613&spUserID=NTE4NDg0Mjk2MTc5S0&spJobID=1840311223&spReportId=MTg0MDMxMTIyMwS2 and https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3. But you somehow forget to point us to the commit which fixes it...................

Please tell us which commit we need.................

[khouloudbelguith]

Hi @michaelKaefer,

You can follow this commit
Find below detailed information about the security fix provided in this version:

CVE reference: CVE-2020-5250
GitHub Security Advisory: GHSA-mhfc-6rhg-fxp3

Thanks!

[PululuK]

Hi @khouloudbelguith

Maybe add this: https://github.com/PrestaShop/PrestaShop/pull/18073 and https://github.com/PrestaShop/PrestaShop/pull/18103 (in progress ...)
Because this Security PR introduces other minor bugs. See https://github.com/PrestaShop/PrestaShop/issues/18072 and https://github.com/PrestaShop/PrestaShop/issues/18100

[michaelKaefer]

@eternoendless As far as I can see Line 89 in classes/form/CustomerForm.php of your commit fixes it? Do we absolutely need the rest to fix this security vulnerability?

$customer = new Customer($this->context->customer->id);

Can you approve this? Thank you.

[PierreRambaud]

@michaelKaefer Yes you need others things to make it work. It's mandatory.

[michaelKaefer]

Ok