PT-2023-29975 · Prestashop+1 · Bl Modules Csvfeeds Module+1

Published 2023-11-27 · Updated 2023-12-01 · CVE-2023-46355

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bl Modules csvfeeds module for PrestaShop versions prior to 2.6.1

Description The issue allows a guest to download personal information without restriction due to too permissive access control. This lack of control does not force the administrator to use a password on feeds, enabling a guest to access exports from the module. As a result, personal information from the ps customer and ps order tables, such as name, surname, email, phone number, and postal address, can be leaked.

Recommendations For versions prior to 2.6.1, update the csvfeeds module to version 2.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the csvfeeds module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-46355

Affected Products

Bl Modules Csvfeeds Module

Prestashop

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-46355 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46355 · Vendor Advisory
• https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html · Note