CVE-2023-46355

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-27 · updated 2026-06-17

Description

In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.

Affected products

Blmodules Csv Feeds Pro: before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: Blmodules Csv Feeds Pro 2.6.1. Check the vendor advisory for mitigations.

References

https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html
https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html

Get alerted when CVE-2023-46355 or the next vulnerability affects your stack