GHSA-8gwj-68w6-7v6c
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | oro/customer-portal | >= 4.2.0, <= 4.2.8 | no fix listed |
| Packagist | oro/customer-portal | >= 5.0.0, < 5.0.11 | 5.0.11 |
| Packagist | oro/customer-portal | >= 5.1.0, < 5.1.1 | 5.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.
References
External links from the advisory. They lead to third-party sites.