{"id":"CVE-2020-16194","aliases":["EUVD-2020-8160","GHSA-xh7c-xrrg-3jv2"],"status":"published","title":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4...","description":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01233,"percentile":0.69256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-639"],"published":"2021-02-04T14:39:14Z","modified":"2026-06-17T02:57:50Z","products":[{"vendor":"store-opart","product":"op\\'art_devis"}],"references":[{"url":"https://github.com/login-securite/CVE/blob/main/CVE-2020-16194.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16194"},{"url":"https://github.com/advisories/GHSA-xh7c-xrrg-3jv2"}],"sources":{"cve":[{"id":"CVE-2020-16194","description":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.","status":"published","published":"2021-02-04T14:39:14Z","modified":"2024-08-04T13:37:54.093Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8160","description":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.","status":"published","published":"2021-02-04T14:39:14Z","modified":"2024-08-04T13:37:54Z","updated_at":"2026-11-03T03:07:28.673063Z"}],"ghsa":[{"id":"GHSA-xh7c-xrrg-3jv2","title":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4...","description":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.","status":"published","published":"2022-05-24T17:40:56Z","modified":"2026-01-27T21:32:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-639"],"updated_at":"2026-11-02T15:05:56.482872Z"}],"nvd":[{"id":"CVE-2020-16194","description":"An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis \u003c 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.","status":"published","published":"2021-02-04T15:15:12.967Z","modified":"2026-06-17T02:57:50.113Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:06:34.188486Z"}]}}