The Customer::getByEmail() method short-circuited and skipped password_verify() when the supplied email did not exist, making responses for non-existing accounts measurably faster. An unauthenticated remote attacker can use this timing oracle to enumerate valid customer email addresses for credential-stuffing, phishing, or password-spray attacks.
This vulnerability affects the following application versions:
- PrestaShop 1.7.2.0
- PrestaShop 1.7.2.0 RC 1
- PrestaShop 1.7.2.0-RC.1.0
- PrestaShop 1.7.2.1
- PrestaShop 1.7.2.2
- PrestaShop 1.7.2.3
- PrestaShop 1.7.2.4
- PrestaShop 1.7.2.5
- PrestaShop 1.7.3.0
- PrestaShop 1.7.3.0 beta 1
- PrestaShop 1.7.3.0 RC 1
- PrestaShop 1.7.3.1
- PrestaShop 1.7.3.2
- PrestaShop 1.7.3.3
- PrestaShop 1.7.3.4
- PrestaShop 1.7.4.0
- PrestaShop 1.7.4.0 beta 1
- PrestaShop 1.7.4.1
- PrestaShop 1.7.4.2
- PrestaShop 1.7.4.3
- PrestaShop 1.7.4.4
- PrestaShop 1.7.5.0
- PrestaShop 1.7.5.0 beta 1
- PrestaShop 1.7.5.0 RC 1
- PrestaShop 1.7.5.0-beta.1
- PrestaShop 1.7.5.0-RC.1
- PrestaShop 1.7.5.1
- PrestaShop 1.7.5.2
- PrestaShop 1.7.6.0
- PrestaShop 1.7.6.0 beta 1
- PrestaShop 1.7.6.0 RC 1
- PrestaShop 1.7.6.0 RC 2
- PrestaShop 1.7.6.0-beta.1
- PrestaShop 1.7.6.0-RC.1
- PrestaShop 1.7.6.0-RC.2
- PrestaShop 1.7.6.1
- PrestaShop 1.7.6.2
- PrestaShop 1.7.6.3
- PrestaShop 1.7.6.4
- PrestaShop 1.7.6.4 1
- PrestaShop 1.7.6.5
- PrestaShop 1.7.6.5 1
- PrestaShop 1.7.6.6
- PrestaShop 1.7.6.7
- PrestaShop 1.7.6.8
- PrestaShop 1.7.6.9
- PrestaShop 1.7.7.0
- PrestaShop 1.7.7.0 beta 1
- PrestaShop 1.7.7.0 beta 2
- PrestaShop 1.7.7.0 RC 1
- PrestaShop 1.7.7.0-beta.1
- PrestaShop 1.7.7.0-beta.2
- PrestaShop 1.7.7.0-RC.1
- PrestaShop 1.7.7.1
- PrestaShop 1.7.7.2
- PrestaShop 1.7.7.3
- PrestaShop 1.7.7.4
- PrestaShop 1.7.7.5
- PrestaShop 1.7.7.6
- PrestaShop 1.7.7.7
- PrestaShop 1.7.7.8
- PrestaShop 1.7.7.8 1
- PrestaShop 1.7.8.0
- PrestaShop 1.7.8.0 beta 1
- PrestaShop 1.7.8.0 1
- PrestaShop 1.7.8.0 RC 1
- PrestaShop 1.7.8.0-beta.1
- PrestaShop 1.7.8.0-RC.1
- PrestaShop 1.7.8.1
- PrestaShop 1.7.8.2
- PrestaShop 1.7.8.2 1
- PrestaShop 1.7.8.3
- PrestaShop 1.7.8.4
- PrestaShop 1.7.8.5
- PrestaShop 1.7.8.6
- PrestaShop 1.7.8.7
- PrestaShop 1.7.8.7 1
- PrestaShop 1.7.8.8
- PrestaShop 1.7.8.9
- PrestaShop 1.7.8.10
- PrestaShop 1.7.8.11
- PrestaShop 8.0.0
- PrestaShop 8.0.1
- PrestaShop 8.0.2
- PrestaShop 8.0.3
- PrestaShop 8.0.4
- PrestaShop 8.0.5
- PrestaShop 8.1.0
- PrestaShop 8.1.1
- PrestaShop 8.1.2
- PrestaShop 8.1.3
- PrestaShop 8.1.4
- PrestaShop 8.1.5
- PrestaShop 8.1.6
- PrestaShop 8.1.7
- PrestaShop 8.2.0
- PrestaShop 8.2.1
- PrestaShop 8.2.2
- PrestaShop 8.2.3
- PrestaShop 9.0.0
- PrestaShop 9.0.0-1.0-RC.1
- PrestaShop 9.0.1
- PrestaShop 9.0.1-1.0
- PrestaShop 9.0.2
- PrestaShop 9.0.2-2.0
- PrestaShop 9.1.0
- PrestaShop 9.1.0-3.0-beta.1
- PrestaShop 9.1.0-4.0
- PrestaShop 9.1.0-4.0-RC.1
- PrestaShop 9.1.1
- PrestaShop 9.1.2
- PrestaShop 9.1.3
- PrestaShop 9.1.3-5.0
- PrestaShop 9.1.4
- PrestaShop 9.1.4-5.0