CVE-2023-32065
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedOroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceOroCommerce contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated or possibly unauthenticated users to access detailed order total information by specifying an Order ID. The application fails to properly validate that the requesting user has authorization to view the specific order's financial details, resulting in sensitive pricing and totals information disclosure.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 4.2.0, <= 4.2.10>= 5.0.0, < 5.0.11>= 5.1.0, < 5.1.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the installed OroCommerce versionLocate the version file in the OroCommerce installation directory, typically found in a composer.json file or a version.php file in the application root or config directory. Alternatively, access the admin panel and check the system information or about page.Affected if The installed version matches one of the affected ranges: 4.2.0 through 4.2.10, 5.0.0 through 5.0.10, or 5.1.0 through 5.1.0.
-
Verify order management functionality is activeConfirm that the e-commerce application has order management enabled. Check the application configuration or database for active sales order modules or the presence of order-related database tables such as oro_order or similar order tables.Affected if Order management functionality is installed and active in the application.
-
Inspect order total API endpointsReview the API endpoints accessible for order retrieval. Check for endpoints that return order data including total amounts, such as GET requests to order retrieval paths. Look for endpoints that accept an order ID parameter without requiring ownership verification in the request path.Affected if API endpoints exist that return order total information and accept order ID as a direct parameter without embedded ownership validation.
-
Test order access authorizationUsing a low-privileged or unauthenticated test account, attempt to access order total information by directly specifying an order ID in the request. Observe whether the response includes detailed financial totals such as subtotal, tax, shipping, and grand total.Affected if The application returns detailed order total and financial information when queried with an order ID without proper ownership verification.
The environment is affected if the installed OroCommerce version falls within the vulnerable ranges AND the application returns order total financial details when accessed with an order ID without verifying that the requesting user owns or is authorized to view that specific order.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.0.115.1.1
Upgrade to OroCommerce version 5.0.11 or 5.1.1 which contains the patch for this vulnerability. Additionally, implement proper authorization checks to ensure users can only access order information for orders they own or are authorized to view.
OroCommerce 5.0.11 or 5.1.1 (depending on branch)
- 1. Identify the current OroCommerce version by checking the application or composer.json
- 2. For version 4.2.0-4.2.10: Upgrade directly to version 5.0.11 or 5.1.1 (4.2.x branch has no patch)
- 3. For version 5.0.0-5.0.10: Upgrade to version 5.0.11 or higher
- 4. For version 5.1.0: Upgrade to version 5.1.1 or higher
- 5. Before upgrading in production, test the upgrade in a staging environment to verify compatibility
- 6. After upgrading, verify that order totals now require proper authentication/authorization
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-32065 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-32065 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data