CVE-2023-46346
HIGHMyPrestaModules for PrestaShop <4.1.1 - Path Traversal
Title source: llmDescription
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
References (1)
Core 1
Core References
Third Party Advisory
https://security.friendsofpresta.org/modules/2023/10/24/exportproducts.html
Scores
CVSS v3
7.5
EPSS
0.0080
EPSS Percentile
51.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (1)
myprestamodules/exportproducts
< 5.0.0
Published
Oct 25, 2023
Tracked Since
Feb 18, 2026