CVE-2023-32064

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-32064
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32064.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-32064
Aliases
Published
2023-11-28T03:34:17.414Z
Modified
2025-12-04T23:51:17.199089Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Details

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32064.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/oroinc/orocommerce

Affected ranges

Type
GIT
Repo
https://github.com/oroinc/orocommerce
Events
Introduced
4f84e69298456fa41df5331bdfe5af79e529a099
Last affected
765302da0de10023c23bfde60e0f0feca93cfac9
Database specific 
{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/oroinc/orocommerce
Events
Introduced
c2cd64739319fe0c592a64a94c727ed3a091b999
Fixed
4257b3c999a99ed751cc6a839a87ac994d2d7f70
Database specific 
{
    "versions": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/oroinc/orocommerce
Events
Introduced
5819184990cb46a634a3bd78e05a61fe63deef49
Fixed
3635983552d818bcdb99a427fb00429eee73c3e9
Database specific 
{
    "versions": [
        {
            "introduced": "5.1.0"
        },
        {
            "fixed": "5.1.1"
        }
    ]
}

Affected versions

4.*

4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8

5.*

5.0.0
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32064.json"