← voltar
CVE-2023-32064

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

CVSS 5 MEDIUMEPSS 0.5%CWE-284
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
oroinc · orocommerce

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →