CVE-2024-34991: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High · fixed in 1.3.4 : patch affected systems soon.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-34991, organizations should take the following specific actions: 1) Immediately verify the version of the Axepta module installed in their PrestaShop environment and upgrade to version 1.3.4 or later as soon as it becomes available, as this version addresses the permissions control issue. 2) In the interim, restrict access to the module's data endpoints by implementing web application firewall (WAF) rules that block unauthenticated requests attempting to access sensitive data paths. 3) Conduct a thorough audit of access control configurations within the PrestaShop installation to ensure that sensitive customer data is only accessible to authenticated and authorized users. 4) Monitor server logs and network traffic for unusual or repeated access attempts to payment module resources from guest users or unknown IP addresses. 5) Employ data minimization practices by limiting the amount of sensitive information stored or displayed in the module to reduce exposure risk. 6) Educate customer service and IT teams about the vulnerability to recognize potential exploitation indicators and respond promptly. 7) Prepare an incident response plan to address potential data leakage, including customer notification procedures in compliance with applicable data protection regulations. 8) Engage with the module vendor or community to stay informed about patches, advisories, and best practices related to Axepta and PrestaShop security.
Description
In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc.without restriction due to a lack of permissions control.