[Security-news] Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-021

Project: Commerce View Receipt [1]
Date: 2024-May-22
Security risk: *Moderately critical* 13∕25
AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <1.0.3
Description: 
The Commerce View Receipts module enables you to view commerce order receipts
in the browser.

The module doesn't sufficiently check access permissions, allowing a
malicious to view the private information of other customers.

Solution: 
Install the latest version.

   * If you use the Commerce View Receipts module for Drupal, upgrade to
     Commerce View Receipts 1.0.3 [3].

Sites may wish to temporarily revoke the "view receipts" permission from most
roles until the site can be upgraded to the latest version.

Reported By: 
   * Norman Kämper-Leymann [4]

Fixed By: 
   * Norman Kämper-Leymann [5]
   * Greg Mack [6]
   * Greg Knaddison [7] of the Drupal Security Team
   * Drew Webber [8] of the Drupal Security Team

Coordinated By: 
   * Greg Knaddison [9] of the Drupal Security Team
   * Juraj Nemec [10] of the Drupal Security Team
   * xjm [11] of the Drupal Security Team


[1] https://www.drupal.org/project/commerce_view_receipt
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/commerce_view_receipt/releases/1.0.3
[4] https://www.drupal.org/user/2482808
[5] https://www.drupal.org/user/2482808
[6] https://www.drupal.org/user/336930
[7] https://www.drupal.org/user/36762
[8] https://www.drupal.org/user/255969
[9] https://www.drupal.org/user/36762
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm