MEDIUM5.3
GHSA-7pjr-2rgh-fc5g
Anonymous PrestaShop customer can download other customers' invoices
Quick fix
GHSA-7pjr-2rgh-fc5g — prestashop/prestashop: upgrade to the fixed version with the command below.
composer require prestashop/prestashop:^8.1.6Details
### Impact Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url.
### Patches Patched in 8.1.6
### Workarounds Upgrade to 8.1.6
Thank you to Samuel Bodevin, who found this vulnerability and shared it with the PrestaShop team.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/prestashop/prestashop
Introduced in:
8.1.5Fixed in: 8.1.6Fix
composer require prestashop/prestashop:^8.1.6References
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pjr-2rgh-fc5g[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-34717[ADVISORY]
- https://github.com/PrestaShop/PrestaShop/commit/46b9a2b430dd2008ac061fbcbae9f7af55a7920a[WEB]
- https://github.com/PrestaShop/PrestaShop[PACKAGE]
- https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6[WEB]