« Volver al listado

CVE-2023-32064

Estado: ModificadaMedia (4.3)—

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oroinc — Orocommerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-32064",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "oroinc",
          "product": "orocommerce",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.0, <= 4.2.8"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.0.11"
            },
            {
              "status": "affected",
              "version": ">= 5.1.0, < 5.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-28T04:15:07.360",
  "references": [
    {
      "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-8gwj-68w6-7v6c",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-8gwj-68w6-7v6c",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.\n\n"
    },
    {
      "lang": "es",
      "value": "Paquete OroCommerce con portal para clientes y funciones básicas de sitio web para visitantes no autenticados. Los usuarios del back-office pueden acceder a información sobre los menús del Cliente y del Usuario del Cliente, evitando las restricciones de seguridad de ACL debido a controles de seguridad insuficientes. Este problema se solucionó en las versiones 5.0.11 y 5.1.1."
    }
  ],
  "lastModified": "2026-06-17T05:57:59.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E0C45BF-56A3-480F-AC47-7811E56CF653",
              "versionEndIncluding": "4.2.8",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A2DBB10-E76F-4210-943D-9FF29CD90538",
              "versionEndExcluding": "5.0.11",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA4A911B-D810-45B3-BCAA-ABD4EF968657",
              "versionEndExcluding": "5.1.1",
              "versionStartIncluding": "5.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}