OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

CVE-2023-32064 is an access control vulnerability in OroCommerce, a B2B e-commerce platform. The issue stems from insufficient security checks for Customer and Customer User menus, allowing back-office users to access these menus even when they should be restricted by ACL [1].

An attacker with back-office user privileges can exploit this by navigating to the Customer or Customer User menus, bypassing the intended access controls. No additional authentication or network position is required beyond being a legitimate back-office user [2].

Successful exploitation leads to unauthorized access to customer information, including potentially sensitive data from the Customer and Customer User menus. This violates confidentiality and can lead to data leakage [1].

The issue has been patched in OroCommerce versions 5.0.11 and 5.1.1. Users are advised to upgrade to these or later versions to remediate the vulnerability [2].