CVE-2023-32064

—

CVSS 3.1

4.3 medium

EPSS

<1%p41

Published

Nov 28, 2023 (Nov 28, 2023)

Modified

Jun 17, 2026

Description

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

Vendors: oroinc
Products: orocommerce
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.