// For flags

CVE-2023-46354

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.

En el módulo "Orders (CSV, Excel) Export PRO" (ordersexport) &lt; 5.2.0 de MyPrestaModules para PrestaShop, un invitado puede descargar información personal sin restricciones. Debido a la falta de control de permisos, un invitado puede acceder a las exportaciones desde el módulo, lo que puede provocar una filtración de información personal de las tablas ps_customer/ps_address, como nombre/apellido/correo electrónico/número de teléfono/dirección postal completa.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-10-23 CVE Reserved
  • 2023-12-06 CVE Published
  • 2024-08-02 CVE Updated
  • 2025-01-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
References (1)
URL Tag Source
https://security.friendsofpresta.org/modules/2023/11/28/ordersexport.html Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Myprestamodules
Search vendor "Myprestamodules"
 Orders \(csv\, Excel\) Export Pro
Search vendor "Myprestamodules" for product "Orders \(csv\, Excel\) Export Pro"
 < 5.2.0
Search vendor "Myprestamodules" for product "Orders \(csv\, Excel\) Export Pro" and version " < 5.2.0"
prestashop
Affected