MEDIUM4.3

GHSA-8gwj-68w6-7v6c

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

Quick fix

GHSA-8gwj-68w6-7v6c — oro/customer-portal: upgrade to the fixed version with the command below.

composer require oro/customer-portal:^5.0.11

Details

Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/oro/customer-portal

Introduced in: 4.2.0

No fixed version published yet for oro/customer-portal (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/customer-portal

Introduced in: 5.0.0Fixed in: 5.0.11

Fixcomposer require oro/customer-portal:^5.0.11

Packagist/oro/customer-portal

Introduced in: 5.1.0Fixed in: 5.1.1

Fixcomposer require oro/customer-portal:^5.1.1

References

https://github.com/oroinc/orocommerce/security/advisories/GHSA-8gwj-68w6-7v6c[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-32064[ADVISORY]
https://github.com/oroinc/orocommerce[PACKAGE]