GHSA-8gwj-68w6-7v6cMediumCVSS 4.3

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

Published
November 27, 2023
Last Modified
December 4, 2023

🔗 CVE IDs covered (1)

CVE-2023-32064 →

📋 Description

Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.

🎯 Affected products3

  • composer/oro/customer-portal:>= 4.2.0, <= 4.2.8
  • composer/oro/customer-portal:>= 5.0.0, < 5.0.11
  • composer/oro/customer-portal:>= 5.1.0, < 5.1.1

🔗 References (3)