CVE-2023-46346 Path traversal in n/a
A guest can perform a path traversal attack to download personal information and view all files on the system due to missing permission controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46346?
CVE-2023-46346 is a high-severity path traversal vulnerability in n/a, published on 25 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
Weakness: CWE-22
Which versions are affected by CVE-2023-46346?
It affects 1 product.
Products include Myprestamodules Exportproducts.
How do I fix CVE-2023-46346?
No fix has been published for CVE-2023-46346 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-46346 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46346 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w62m-8695-jpgw.