GHSA-wwqh-cf9m-347f: PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a customer. The vulnerability is reachable over the network and does not require user interaction.
What access or impact does successful exploitation provide?
An authenticated attacker can submit arbitrary customer identifiers when creating GDPR consent log entries. This lets them forge consent records for other customers and corrupt the audit log, affecting integrity rather than confidentiality or availability.
Which versions should be investigated?
PrestaShop psgdpr versions through 1.4.3 are affected. The provided data does not identify a fixed version.