Описание
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.
Пакеты
Наименование
oro/customer-portal
composer
Затронутые версииВерсия исправления
>= 4.2.0, <= 4.2.8
Отсутствует
Наименование
oro/customer-portal
composer
Затронутые версииВерсия исправления
>= 5.0.0, < 5.0.11
5.0.11
Наименование
oro/customer-portal
composer
Затронутые версииВерсия исправления
>= 5.1.0, < 5.1.1
5.1.1
Связанные уязвимости
CVSS3: 5
nvd
около 2 лет назад
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.