medium4.3
CVE-2023-32064
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Impact
Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/customer-portal | >= 4.2.0, <= 4.2.8 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Orocommerce | from 4.2.0 through 4.2.8 from 5.0.0 before 5.0.11 from 5.1.0 before 5.1.1 |