CVE-2024-34717: Anonymous PrestaShop customer can download other customers' invoices
Impact Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url.
Patches Patched in 8.1.6
Workarounds Upgrade to 8.1.6
Thank you to Samuel Bodevin, who found this vulnerability and shared it with the PrestaShop team.
Other sources
PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34717?
The severity of CVE-2024-34717 is high due to its potential for unauthorized access to invoices.
How do I fix CVE-2024-34717?
To fix CVE-2024-34717, upgrade your PrestaShop installation to version 8.1.6 or later.
What versions of PrestaShop are affected by CVE-2024-34717?
CVE-2024-34717 affects PrestaShop version 8.1.5.
Can CVE-2024-34717 be exploited in anonymous mode?
Yes, CVE-2024-34717 can be exploited in anonymous mode by providing a random secure_key in the URL.
Who discovered CVE-2024-34717?
CVE-2024-34717 was discovered by Samuel Bodevin.