CVE-2023-32064
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
28 Nov 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected products
oroinc · orocommerceWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →