In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.
References
| Link | Resource |
|---|---|
| https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html | Third Party Advisory |
Configurations
History
01 Dec 2023, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:blmodules:csv_feeds_pro:*:*:*:*:*:prestashop:*:* | |
| First Time |
Blmodules
Blmodules csv Feeds Pro |
|
| References | () https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html - Third Party Advisory |
27 Nov 2023, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-27 23:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-46355
Mitre link : CVE-2023-46355
CVE.ORG link : CVE-2023-46355
JSON object : View
Products Affected
blmodules
- csv_feeds_pro
CWE