References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST NVD-CWE-Other

OR
     *cpe:2.3:a:blmodules:csv_feeds_pro:*:*:*:*:*:prestashop:*:* versions up to (excluding) 2.6.1

https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html No Types Assigned

https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html Third Party Advisory

In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.

MITRE https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html [No types assigned]