CVE-2016-2212

The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3…

published April 15, 2016

CVSS
—
EPSS
3%
Percentile
85.7
In the wild
Unconfirmed
What it is

The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02687 · 85.7th percentile
Published
2016-04-15T14:00Z
EPSS history
Timeline
  • 15 APR 14:00Z
    The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3…
    cvelistv5