p PatchFirst

PatchFirst · Latest vulnerabilities

oro/customer-portal vulnerabilities

Vulnerabilities published for oro/customer-portal in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2023-48296

    Medium · CVSS 4.3EPSS 0.44%Fix available

    OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

    OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

    oro/customer-portal oro/customer-portal oro/customer-portal oro/customer-portalPHP
    • Update to 5.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-32064

    Medium · CVSS 5EPSS 0.5%Fix available

    OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

    OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

    oro/customer-portal oro/customer-portal oro/customer-portalPHP
    • Update to 5.0.11
    • Update to 5.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →