p PatchFirst

CVE-2023-32065

CVE-2023-32065 · OroCommerce get-totals-for-checkout API endpoint returns unwanted data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.

CVSS 5.8 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • orocommerce

    Versions
    • >= 4.2.0, <= 4.2.10: Affected
    • >= 5.0.0, < 5.0.11: Affected
    • >= 5.1.0, < 5.1.1: Affected

    No fix published

  • oro/commerce Packagist

    Versions
    • 4.2.0
    • 4.2.1
    • 4.2.10
    • 4.2.2
    • 4.2.3
    • 4.2.4
    • 4.2.5
    • 4.2.6
    • 4.2.7
    • 4.2.8
    • 4.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 4.2.0, ≤ 4.2.10

    No fix published

  • oro/commerce Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.10
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 5.0.8
    • 5.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.11

    Update to 5.0.11

  • oro/commerce Packagist

    Versions
    • 5.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.1.0, < 5.1.1

    Update to 5.1.1

Original sources

Check your server →