p PatchFirst

CVE-2023-32064

CVE-2023-32064 · OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

CVSS 5.0 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • orocommerce

    Versions
    • >= 4.2.0, <= 4.2.8: Affected
    • >= 5.0.0, < 5.0.11: Affected
    • >= 5.1.0, < 5.1.1: Affected

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 4.2.0
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.2.4
    • 4.2.5
    • 4.2.6
    • 4.2.7
    • 4.2.8
    Affected ranges
    • ECOSYSTEM: ≥ 4.2.0, ≤ 4.2.8

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.10
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 5.0.8
    • 5.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.11

    Update to 5.0.11

  • oro/customer-portal Packagist

    Versions
    • 5.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.1.0, < 5.1.1

    Update to 5.1.1

Original sources

Check your server →