ESLog inGet started free
High 7.5 CVSS 3.1 paypal Published on 2024-07-26

In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious…

CVECVE-2024-41670 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
High 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: paypal
All paypal advisories (3)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2023-28843 PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment… paypal Critical 9.8 ≥ 3.12.0 < 3.16.4 2023-03-31 Yes
CVE-2012-5801 The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common… paypal Medium 5.8 — 2012-11-04 No

Do you use the paypal module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected