Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2023-32065

OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

oroinc orocommerce

  • >= 4.2.0, <= 4.2.10affected
  • >= 5.0.0, < 5.0.11affected
  • >= 5.1.0, < 5.1.1affected

References