title: OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
description: OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
problem types: CWE-284: Improper Access Control
affected:
{
vendor: oroinc
product: orocommerce
versions:
version: >= 4.2.0, <= 4.2.8, status: affected
version: >= 5.0.0, < 5.0.11, status: affected
version: >= 5.1.0, < 5.1.1, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]