{"id":"DRUPAL-CONTRIB-2024-021","details":"The Commerce View Receipts module enables you to view commerce order receipts in the browser.\n\nThe module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers.","aliases":["CVE-2024-13257"],"modified":"2026-09-10T03:45:29.705083120Z","published":"2024-05-22T16:21:55Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2024-021"}],"affected":[{"package":{"name":"drupal/commerce_view_receipt","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_view_receipt?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}],"database_specific":{"constraint":"\u003c1.0.3"}}],"database_specific":{"affected_versions":"\u003c1.0.3","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_view_receipt/DRUPAL-CONTRIB-2024-021.json"}}],"schema_version":"1.9.0","credits":[{"name":"Norman Kämper-Leymann","contact":["https://www.drupal.org/user/2482808"]}]}