Lucene search

GitHub Advisory DatabaseGHSA-88G2-XGH9-4PH2

HistoryNov 27, 2023 - 11:29 p.m.

OroCommerce get-totals-for-checkout API endpoint returns unwanted data

2023-11-2723:29:52

CWE-284

GitHub Advisory Database

github.com

orocommerce

get-totals-for-checkout

api

endpoint

unwanted data

checkout id

software

information security

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Detailed Checkout totals information may be received by Checkout ID

Affected configurations

Vulners

Node

orocommerceRange5.1.0–5.1.1

orocommerceRange5.0.0–5.0.11

orocommerceRange4.2.0–4.2.10

VendorProductVersionCPE
orocommerce*cpe:2.3:a:oro:commerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oro	commerce	*	cpe:2.3:a:oro:commerce::::::::

References

github.com/advisories/GHSA-88g2-xgh9-4ph2

github.com/oroinc/orocommerce/security/advisories/GHSA-88g2-xgh9-4ph2

nvd.nist.gov/vuln/detail/CVE-2023-32065

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Related for GHSA-88G2-XGH9-4PH2