CVE-2023-32064

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-320655.8OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information ma CVE-2023-320665.4Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping t CVE-2023-320677.5c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forg CVE-2023-320686.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's p CVE-2023-320698.8XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible fo CVE-2023-320706.1XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values CVE-2023-320719.0XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's p CVE-2023-320724.8Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version CVE-2023-320738.8WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/clon CVE-2023-320749.8user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended tha CVE-2023-320754.3The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framewo CVE-2023-320765.5in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to con