View online: https://www.drupal.org/sa-contrib-2024-021

Project: Commerce View Receipt [1] Date: 2024-May-22 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass

Affected versions: <1.0.3 Description:  The Commerce View Receipts module enables you to view commerce order receipts in the browser.

The module doesn't sufficiently check access permissions, allowing a malicious to view the private information of other customers.

Solution:  Install the latest version.

* If you use the Commerce View Receipts module for Drupal, upgrade to Commerce View Receipts 1.0.3 [3].

Sites may wish to temporarily revoke the "view receipts" permission from most roles until the site can be upgraded to the latest version.

Reported By:  * Norman Kämper-Leymann [4]

Fixed By:  * Norman Kämper-Leymann [5] * Greg Mack [6] * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team

Coordinated By:  * Greg Knaddison [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team * xjm [11] of the Drupal Security Team

[1] https://www.drupal.org/project/commerce_view_receipt [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_view_receipt/releases/1.0.3 [4] https://www.drupal.org/user/2482808 [5] https://www.drupal.org/user/2482808 [6] https://www.drupal.org/user/336930 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm