Information Disclosure

2024-03-2908:26:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

oroplatform

information disclosure

vulnerability

access control

json

navigation

sensitive information

unauthorized access

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

OroPlatform is vulnerable to Information Disclosure. The vulnerability is due to insufficient access control mechanisms in OroPlatform’s JSON navigation response. Specifically, sensitive navigation history, most viewed, and favorite navigation items are disclosed to a storefront user if their ID matches that of a back-office user. It leads to unauthorized access to sensitive information.