CVE-2024-41670
CVE-2024-41670 in PrestaShop's PayPal Official module allows malicious customers to confirm orders even when PayPal payment fails. This vulnerability affects PrestaShop 7+ versions before 6.4.2 and 1.6 versions before 3.18.1. A logical flaw during payment capture, especially when webhooks are disabled, allows creation of accepted orders with fraudulent payments. The risk involves threat actors confirming orders without valid payment, leading to financial losses. Update to versions 6.4.2 or 3.18.1 and enable/verify webhooks to mitigate this vulnerability. Although the SVRS score is 38 (not critical), immediate patching is advisable to prevent exploitation.
Description
CVE-2024-41670 is a logical weakness in the PayPal Official module for PrestaShop versions prior to 6.4.2 and 3.18.1. This vulnerability allows malicious customers to confirm orders even if payment is declined by PayPal, potentially leading to fraudulent purchases.
Key Insights
- SVRS Score: 38 (Moderate)
- Exploit Status: Active exploits have been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies
- Update PrestaShop to version 6.4.2 or 3.18.1 or later.
- Enable webhooks and ensure they are callable.
- Implement additional security measures, such as two-factor authentication and fraud detection systems.
- Monitor for suspicious activity and take immediate action if any is detected.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.