CVE-2024-34717: Anonymous PrestaShop customer can download other customers' invoices
Impact Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url.
Patches Patched in 8.1.6
Workarounds Upgrade to 8.1.6
Thank you to Samuel Bodevin, who found this vulnerability and shared it with the PrestaShop team.
Other sources
Anonymous PrestaShop customer can download other customers' invoices
— Packagist
PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 8.1.6 - Upgrade
Upgrade
PrestaShopto a version that resolves this vulnerability.Fixed in 8.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34717?
The severity of CVE-2024-34717 is high due to its potential for unauthorized access to invoices.
How do I fix CVE-2024-34717?
To fix CVE-2024-34717, upgrade your PrestaShop installation to version 8.1.6 or later.
What versions of PrestaShop are affected by CVE-2024-34717?
CVE-2024-34717 affects PrestaShop version 8.1.5.
Can CVE-2024-34717 be exploited in anonymous mode?
Yes, CVE-2024-34717 can be exploited in anonymous mode by providing a random secure_key in the URL.
Who discovered CVE-2024-34717?
CVE-2024-34717 was discovered by Samuel Bodevin.