CVE-2023-46355
Medium
Description
In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.
SeverityMedium
CVSS5.3
Exploit probability—
ProductBlmodules Csv Feeds Pro
PublishedNov 27, 2023
First seenNov 27, 2023
How to fix
Update
- blmodules csv_feeds_pro2.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| blmodules csv_feeds_pro | v < 2.6.1 | 2.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.