CVE-2023-32064
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
28 nov 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Productos afectados
oroinc · orocommerce¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →