CVE-2023-32065 OroCommerce get-totals-for-checkout API endpoint returns unwanted data
Attackers can retrieve detailed order totals information via the checkout API, exposing sensitive business data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32065?
CVE-2023-32065 is a medium-severity vulnerability in oroinc orocommerce, published on 28 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
Weakness: CWE-284
Which versions are affected by CVE-2023-32065?
6 open source packages ship an affected version, including oro/commerce. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oro/commerce Packagist | From 4.2.0 to 4.2.10 | None |
oro/commerce Packagist | From 4.2.0 to 4.2.10 | None |
oro/commerce Packagist | From 5.0.0 | 5.0.11 |
oro/commerce Packagist | From 5.0.0 | 5.0.11 |
oro/commerce Packagist | From 5.1.0 | 5.1.1 |
oro/commerce Packagist | From 5.1.0 | 5.1.1 |
Products include Oroinc Orocommerce.
How do I fix CVE-2023-32065?
Upgrade oro/commerce to a fixed version for your release line: 5.0.11 or 5.1.1.
Is CVE-2023-32065 being exploited?
There is no known exploitation of CVE-2023-32065 in the wild and no public exploit code.
Other vulnerabilities in oroinc orocommerce
- CVE-2022-35950 OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
- CVE-2022-31037 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page
- CVE-2023-32064 OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Sources
Also known as GHSA-88g2-xgh9-4ph2.