CVE-2023-32064CWE-284

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

Medium · published November 28, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-11-28T03:34Z
EPSS history
Timeline
  • 28 NOV 03:34Z
    OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
    cvelistv5