{"id":"GHSA-hvgw-gg3p-295j","summary":"Read private customer data reclaiming carts in Klaviyo Magento","details":"A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.\n\n","modified":"2024-11-29T05:40:37.431105Z","published":"2024-05-15T22:03:47Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-05-15T22:03:47Z","nvd_published_at":null,"cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/klaviyo/magento2-klaviyo/pull/107"},{"type":"WEB","url":"https://gist.github.com/JeroenBoersma/f5864a45e3df63b198a57abdff366df2"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/klaviyo/magento2-extension/2021-05-25-1.yaml"},{"type":"PACKAGE","url":"https://github.com/klaviyo/magento2-klaviyo"}],"affected":[{"package":{"name":"klaviyo/magento2-extension","ecosystem":"Packagist","purl":"pkg:composer/klaviyo/magento2-extension"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.0.0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","2.0.0","2.1.0","2.1.1","2.2.0","2.2.0-patch"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-hvgw-gg3p-295j/GHSA-hvgw-gg3p-295j.json"}}],"schema_version":"1.9.0"}