« Volver al listado

CVE-2023-32065

Estado: ModificadaMedia (5.8)—

OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oroinc — Orocommerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-32065",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "oroinc",
          "product": "orocommerce",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.0, <= 4.2.10"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.0.11"
            },
            {
              "status": "affected",
              "version": ">= 5.1.0, < 5.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-28T04:15:07.570",
  "references": [
    {
      "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-88g2-xgh9-4ph2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-88g2-xgh9-4ph2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.\n\n"
    },
    {
      "lang": "es",
      "value": "OroCommerce es una aplicación de comercio entre empresas de código abierto creada teniendo en cuenta la flexibilidad. Se puede recibir información detallada sobre los totales de los pedidos mediante el ID del pedido. Este problema se solucionó en las versiones 5.0.11 y 5.1.1."
    }
  ],
  "lastModified": "2026-06-17T05:58:00.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CD6473A-785F-4EA1-8546-250A24D35964",
              "versionEndIncluding": "4.2.10",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A2DBB10-E76F-4210-943D-9FF29CD90538",
              "versionEndExcluding": "5.0.11",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA4A911B-D810-45B3-BCAA-ABD4EF968657",
              "versionEndExcluding": "5.1.1",
              "versionStartIncluding": "5.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}