CVE-2023-45380

2023-11-0700:00:00

mitre

github.com

order duplicator

prestashop

silbersaiten

personal information

permissions control

cve-2023-45380

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

In the module “Order Duplicator " Clone and Delete Existing Order” (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:silbersaiten:order_duplicator:-:*:*:*:*:prestashop:*:*"
    ],
    "vendor": "silbersaiten",
    "product": "order_duplicator",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.1.7"
      }
    ],
    "defaultStatus": "unknown"
  }
]