CVE-2023-46352

2023-11-0200:00:00

mitre

github.com

pixel plus

facebook module

prestashop

insecure permission control

personal information leakage

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

In the module “Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module” (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email.