GitHub Advisoryadvisory · Packagist

GHSA-88g2-xgh9-4ph2 OroCommerce get-totals-for-checkout API endpoint returns unwanted data

MEDIUM Published 2023-11-27 Modified 2023-11-28 Official page ↗
Aliases
CVE-2023-32065
Ecosystem
Packagist
Packages
oro/commerce
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2023-11-27

Affected packages

• Packagist oro/commerce: >= 4.2.0, <= 4.2.10 (no fix yet) • Packagist oro/commerce: >= 5.0.0, < 5.0.11 → fixed in 5.0.11 • Packagist oro/commerce: >= 5.1.0, < 5.1.1 → fixed in 5.1.1

Description

Detailed Checkout totals information may be received by Checkout ID

Related

Alias · CVE (1)

  • CVE-2023-32065 OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References