GitHub Advisoryadvisory · Packagist

GHSA-hvgw-gg3p-295j Read private customer data reclaiming carts in Klaviyo Magento

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
klaviyo/magento2-extension
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-05-15

Affected packages

• Packagist klaviyo/magento2-extension: >= 1.0.0, < 3.0.0 → fixed in 3.0.0

Description

A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References