High 7.5 CVSS 3.1 exportproducts Published on 2023-10-25

In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can…

CVECVE-2023-46346 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

References

Third Party Advisorysecurity.friendsofpresta.org
https://security.friendsofpresta.org/modules/2023/10/24/exportproducts.html

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: exportproducts

All exportproducts advisories (2)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2023-45387 In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from… exportproducts Critical 9.8 < 5.1.0 2023-11-17 Yes

Do you use the exportproducts module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected