CVE-2023-46346

2023-10-2500:00:00

mitre

github.com

cve-2023-46346

prestashop

guest access

personal information

path traversal

AI Score

6.6

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

In the module “Product Catalog (CSV, Excel, XML) Export PRO” (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:myprestamodules:exportproducts:*:*:*:*:*:*:*:*"
    ],
    "vendor": "myprestamodules",
    "product": "exportproducts",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "4.1.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]