Description
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/oroinc/orocommerce/security/advisories/GHSA-88g2-xgh9-4ph2
Scores
CVSS v3
5.8
EPSS
0.0049
EPSS Percentile
38.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Details
CWE
CWE-284
Status
published
Products (2)
oro/commerce
4.2.0Packagist
oroinc/orocommerce
4.2.0 - 4.2.10
Published
Nov 28, 2023
Tracked Since
Feb 18, 2026