CVE-2024-34717
Anonymous PrestaShop customer can download other customers' invoices
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Anonymous PrestaShop customer can download other customers' invoices
PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
Reserved 2024-05-07 | Published 2024-05-14 | Updated 2024-08-02 | Assigner GitHub_MCWE-200: Exposure of Sensitive Information to an Unauthorized Actor
github.com/...taShop/security/advisories/GHSA-7pjr-2rgh-fc5g
github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
Support options
