PT-2020-17101 · WordPress · Woocommerce

Published 2020-12-27 · Updated 2024-03-22 · CVE-2020-29156

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce plugin versions prior to 4.7.0

Description The issue allows remote attackers to view the status of arbitrary orders via the order id parameter in a fetch order status action. This could potentially expose sensitive information about orders.

Recommendations For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the fetch order status action to minimize the risk of exploitation. Avoid using the order id parameter in the affected action until the issue is resolved.

Exploit

Fix

Incorrect Authorization

IDOR

Weakness Enumeration

CWE-863

CWE-639

Related Identifiers

CVE-2020-29156

GHSA-WWH8-V3J3-GXFW

Affected Products

Woocommerce

References · 10

• 🔥 https://github.com/Ko-kn3t/CVE-2020-29156 · Exploit
• https://osv.dev/vulnerability/GHSA-wwh8-v3j3-gxfw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29156 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29156 · Vendor Advisory
• https://github.com/woocommerce/woocommerce · Note
• https://t.me/cibsecurity/21327 · Telegram Post
• https://twitter.com/Debug_sec/status/1771118242704064967 · Twitter Post
• https://t.me/cvenotify/7932 · Telegram Post
• https://raw.githubusercontent.com/woocommerce/woocommerce/master/changelog.txt · Note
• https://t.me/cvenotify/7791 · Telegram Post