← CVE Intelligence

CVE-2023-32064

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility PUBLISHED

Description (CNA)

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

Affected (CNA)

Vendor / productVersions
oroinc / orocommerceaffected >= 4.2.0, <= 4.2.8; affected >= 5.0.0, < 5.0.11; affected >= 5.1.0, < 5.1.1

CWE

CWE-284

References

ADP enrichment

CVE

No English description supplied.