High 7.5 CVSS 3.1 ordersexport Published on 2023-12-06

In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without…

CVECVE-2023-46354 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

References

Third Party Advisorysecurity.friendsofpresta.org
https://security.friendsofpresta.org/modules/2023/11/28/ordersexport.html

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ordersexport

All ordersexport advisories (3)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2024-28396 An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the… ordersexport High 7.5 ≤ 6.0.2 2024-03-20 No

CVE-2023-40923 MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php… ordersexport High 8.8 < 5.0 2023-11-15 Yes

Do you use the ordersexport module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected