Lucene search

MitreCVE-2023-46346

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-46346

2023-10-2518:17:37

CWE-22

mitre

web.nvd.nist.gov

cve-2023-46346

path traversal

prestashop

myprestamodules

security vulnerability

information disclosure

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

In the module “Product Catalog (CSV, Excel, XML) Export PRO” (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.

Affected configurations

Nvd

Node

myprestamodulesexportproductsRange<5.0.0prestashop

VendorProductVersionCPE
myprestamodulesexportproducts*cpe:2.3:a:myprestamodules:exportproducts:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
myprestamodules	exportproducts	*	cpe:2.3:a:myprestamodules:exportproducts::::::prestashop::*

References

security.friendsofpresta.org/modules/2023/10/24/exportproducts.html

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Related for CVE-2023-46346