Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-265g-8wx4-j3gp

Summary

Storefront user can access history and most viewed data from matching back-office user with the same ID
Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.

Aliases

alias	CVE-2023-48296

alias	GHSA-v7px-46v9-5qwp

Fixed_packages

url	pkg:composer/oro/customer-portal@4.2.0-alpha
purl	pkg:composer/oro/customer-portal@4.2.0-alpha
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.0-alpha

url	pkg:composer/oro/customer-portal@5.0.0-alpha.1
purl	pkg:composer/oro/customer-portal@5.0.0-alpha.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.0-alpha.1

url	pkg:composer/oro/customer-portal@5.1.0-alpha.1
purl	pkg:composer/oro/customer-portal@5.1.0-alpha.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.0-alpha.1

url	pkg:composer/oro/customer-portal@5.1.4
purl	pkg:composer/oro/customer-portal@5.1.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.4

Affected_packages

url pkg:composer/oro/customer-portal@4.1.0

purl pkg:composer/oro/customer-portal@4.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.0

url pkg:composer/oro/customer-portal@4.1.1-rc

purl pkg:composer/oro/customer-portal@4.1.1-rc

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.1-rc

url pkg:composer/oro/customer-portal@4.1.1-rc2

purl pkg:composer/oro/customer-portal@4.1.1-rc2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.1-rc2

url pkg:composer/oro/customer-portal@4.1.1

purl pkg:composer/oro/customer-portal@4.1.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.1

url pkg:composer/oro/customer-portal@4.1.2

purl pkg:composer/oro/customer-portal@4.1.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.2

url pkg:composer/oro/customer-portal@4.1.3

purl pkg:composer/oro/customer-portal@4.1.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.3

url pkg:composer/oro/customer-portal@4.1.4

purl pkg:composer/oro/customer-portal@4.1.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.4

url pkg:composer/oro/customer-portal@4.1.5

purl pkg:composer/oro/customer-portal@4.1.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.5

url pkg:composer/oro/customer-portal@4.1.6

purl pkg:composer/oro/customer-portal@4.1.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.6

url pkg:composer/oro/customer-portal@4.1.7

purl pkg:composer/oro/customer-portal@4.1.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.7

url pkg:composer/oro/customer-portal@4.1.8

purl pkg:composer/oro/customer-portal@4.1.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.8

url pkg:composer/oro/customer-portal@4.1.9

purl pkg:composer/oro/customer-portal@4.1.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.9

url pkg:composer/oro/customer-portal@4.1.10

purl pkg:composer/oro/customer-portal@4.1.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.10

url pkg:composer/oro/customer-portal@4.1.11

purl pkg:composer/oro/customer-portal@4.1.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.11

url pkg:composer/oro/customer-portal@4.1.12

purl pkg:composer/oro/customer-portal@4.1.12

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.12

url pkg:composer/oro/customer-portal@4.1.13

purl pkg:composer/oro/customer-portal@4.1.13

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.1.13

url pkg:composer/oro/customer-portal@4.2.0

purl pkg:composer/oro/customer-portal@4.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.0

url pkg:composer/oro/customer-portal@4.2.1

purl pkg:composer/oro/customer-portal@4.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.1

url pkg:composer/oro/customer-portal@4.2.2

purl pkg:composer/oro/customer-portal@4.2.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.2

url pkg:composer/oro/customer-portal@4.2.3

purl pkg:composer/oro/customer-portal@4.2.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.3

url pkg:composer/oro/customer-portal@4.2.4

purl pkg:composer/oro/customer-portal@4.2.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.4

url pkg:composer/oro/customer-portal@4.2.5

purl pkg:composer/oro/customer-portal@4.2.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.5

url pkg:composer/oro/customer-portal@4.2.6

purl pkg:composer/oro/customer-portal@4.2.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.6

url pkg:composer/oro/customer-portal@4.2.7

purl pkg:composer/oro/customer-portal@4.2.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.7

url pkg:composer/oro/customer-portal@4.2.8

purl pkg:composer/oro/customer-portal@4.2.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.8

url pkg:composer/oro/customer-portal@4.2.10

purl pkg:composer/oro/customer-portal@4.2.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@4.2.10

url pkg:composer/oro/customer-portal@5.0.0

purl pkg:composer/oro/customer-portal@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.0

url pkg:composer/oro/customer-portal@5.0.1

purl pkg:composer/oro/customer-portal@5.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.1

url pkg:composer/oro/customer-portal@5.0.2

purl pkg:composer/oro/customer-portal@5.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.2

url pkg:composer/oro/customer-portal@5.0.3

purl pkg:composer/oro/customer-portal@5.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.3

url pkg:composer/oro/customer-portal@5.0.4

purl pkg:composer/oro/customer-portal@5.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.4

url pkg:composer/oro/customer-portal@5.0.5

purl pkg:composer/oro/customer-portal@5.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.5

url pkg:composer/oro/customer-portal@5.0.6

purl pkg:composer/oro/customer-portal@5.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.6

url pkg:composer/oro/customer-portal@5.0.7

purl pkg:composer/oro/customer-portal@5.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.7

url pkg:composer/oro/customer-portal@5.0.8

purl pkg:composer/oro/customer-portal@5.0.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.8

url pkg:composer/oro/customer-portal@5.0.9

purl pkg:composer/oro/customer-portal@5.0.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.9

url pkg:composer/oro/customer-portal@5.0.10

purl pkg:composer/oro/customer-portal@5.0.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.10

url pkg:composer/oro/customer-portal@5.0.11

purl pkg:composer/oro/customer-portal@5.0.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.0.11

url pkg:composer/oro/customer-portal@5.1.0

purl pkg:composer/oro/customer-portal@5.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

vulnerability	VCID-qanp-tf8d-zbhw

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.0

url pkg:composer/oro/customer-portal@5.1.1

purl pkg:composer/oro/customer-portal@5.1.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.1

url pkg:composer/oro/customer-portal@5.1.2

purl pkg:composer/oro/customer-portal@5.1.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.2

url pkg:composer/oro/customer-portal@5.1.3

purl pkg:composer/oro/customer-portal@5.1.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-265g-8wx4-j3gp

resource_url http://public2.vulnerablecode.io/packages/pkg:composer/oro/customer-portal@5.1.3

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2023-48296

reference_id

reference_type

scores

value	0.00229
scoring_system	epss
scoring_elements	0.45791
published_at	2026-06-06T12:55:00Z

value	0.00229
scoring_system	epss
scoring_elements	0.45759
published_at	2026-06-09T12:55:00Z

value	0.00229
scoring_system	epss
scoring_elements	0.45746
published_at	2026-06-08T12:55:00Z

value	0.00229
scoring_system	epss
scoring_elements	0.45771
published_at	2026-06-07T12:55:00Z

value	0.00229
scoring_system	epss
scoring_elements	0.45788
published_at	2026-06-05T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2023-48296

reference_url

https://github.com/oroinc/orocommerce

reference_id

reference_type

scores

value	4.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/oroinc/orocommerce

reference_url

https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8

reference_id

reference_type

scores

value	4.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-01T19:44:56Z/

url

https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2023-48296

reference_id

CVE-2023-48296

reference_type

scores

value	4.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2023-48296

reference_url

https://github.com/advisories/GHSA-v7px-46v9-5qwp

reference_id

GHSA-v7px-46v9-5qwp

reference_type

scores

value	MODERATE
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-v7px-46v9-5qwp

reference_url

https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp

reference_id

GHSA-v7px-46v9-5qwp

reference_type

scores

value	4.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	cvssv3.1_qr
scoring_elements

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-01T19:44:56Z/

url

https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp

Weaknesses

cwe_id	200
name	Exposure of Sensitive Information to an Unauthorized Actor
description	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 4.0 - 6.9

Exploitability 0.5

Weighted_severity 6.2

Risk_score 3.1

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-265g-8wx4-j3gp

Vulnerability Instance