CVE-2023-25170
PrestaShop has possible CSRF token fixation
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
PrestaShop has possible CSRF token fixation
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Record
CVE-2023-25170- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2023-0848
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Record
EUVD-2023-0848- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3g43-x7qr-96ph
Possible CSRF token fixation
Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
Patches
The problem is fixed in version 8.0.1
- Record
GHSA-3g43-x7qr-96ph- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Record
CVE-2023-25170- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
PrestaShop has possible CSRF token fixation
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Record
CVE-2023-25170- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-3g43-x7qr-96ph
Possible CSRF token fixation
Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
Patches
The problem is fixed in version 8.0.1
- Record
GHSA-3g43-x7qr-96ph- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prestashop/prestashopPackagist |
before 8.0.1 | 8.0.1 |
prestashop/prestashopPackagist |
before 8.0.1, plus listed versions 1.7.0.01.7.0.0-beta.1.01.7.0.0-beta.2.01.7.0.0-beta.3.01.7.0.0-beta.4.0 Show 45 moreShow less1.7.0.0-rc.0.01.7.0.0-rc.1.01.7.0.0-rc.2.01.7.0.11.7.0.21.7.0.31.7.0.41.7.0.51.7.0.61.7.1.01.7.1.11.7.1.21.7.2.01.7.2.0-rc.1.01.7.2.11.7.2.21.7.2.31.7.2.41.7.2.51.7.3.01.7.3.11.7.3.21.7.3.31.7.3.41.7.4.01.7.4.0-beta.11.7.4.11.7.4.21.7.4.31.7.4.41.7.5.01.7.5.0-beta.11.7.5.0-rc.11.7.5.11.7.5.21.7.6.01.7.6.0-beta.11.7.6.0-rc.11.7.6.0-rc.21.7.6.11.7.6.21.7.6.31.7.6.41.7.6.51.7.6.6 |
8.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25170 is a medium vulnerability (CVSS 5.0) in Prestashop, published March 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in prestashop/prestashop 8.0.1.
References
Left out here: 32 versions. The JSON record has them.