CVE-2024-41670 PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard
Attackers can confirm orders with declined payments if webhooks are disabled, allowing fraudulent purchases in PrestaShop stores.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41670?
CVE-2024-41670 is a high-severity vulnerability in 202ecommerce paypal, published on 26 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable.
Which versions are affected by CVE-2024-41670?
How do I fix CVE-2024-41670?
No fix has been published for CVE-2024-41670 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41670 being exploited?
There is no known exploitation of CVE-2024-41670 in the wild and no public exploit code.
Sources
Also known as GHSA-w3w3-j3mh-3354.