We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2024-34717

Anonymous PrestaShop customer can download other customers' invoices

Reserved:2024-05-07
Published:2024-05-14
Updated:2024-05-14

Description

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.



MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

= 8.1.5
affected

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pjr-2rgh-fc5g

https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6

cve.org CVE-2024-34717

nvd.nist.gov CVE-2024-34717

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-34717