CVE-2024-34717: 
PHP vulnerability analysis and mitigation

CVE-2024-34717 affects PrestaShop, an open source e-commerce web application. The vulnerability was discovered in version 8.1.5, where any invoice can be downloaded from the front-office in anonymous mode by supplying a random secure_key parameter in the URL. The vulnerability was discovered by Samuel Bodevin and was patched in version 8.1.6 (PrestaShop Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and has a limited impact on confidentiality with no impact on integrity or availability. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (PrestaShop Advisory).

The vulnerability allows unauthorized individuals to download invoices belonging to other customers, potentially exposing sensitive financial information and customer data (Security Online).

The vulnerability can be exploited by supplying a random secure_key parameter in the URL while accessing the front-office in anonymous mode. No special privileges or user interaction is required for exploitation (PrestaShop Advisory).

The vulnerability has been patched in PrestaShop version 8.1.6. Users are strongly advised to upgrade to this latest version to protect their stores and customer data. No known workarounds are available (NVD).