-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper access control in the invoice download endpoint. The key evidence is in the commit diff showing the security check was restructured from a single flawed conditional (that could be bypassed with any secure_key) to two separate checks. The postProcess method in PdfInvoiceController.php directly handles authorization for invoice downloads and contained the insecure logic before patching. The function's role in processing PDF requests and the explicit security fix in this method confirm its vulnerability.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/prestashop | composer | = 8.1.5 | 8.1.6 |
KEV Misses 88% of Exploited CVEs- Get the report