PT-2024-40329 · Klaviyo · Klaviyo Magento 2

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Klaviyo Magento 2 (affected versions not specified)

Description A researcher discovered an issue in a third-party module that allows reading private customer data from stores. This is achieved by reclaiming any guest-cart as one's own and then accessing the private data for orders through the Magento API. The endpoint in question enables this unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-HVGW-GG3P-295J

Affected Products

Klaviyo Magento 2

References · 5

• https://osv.dev/vulnerability/GHSA-hvgw-gg3p-295j · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/klaviyo/magento2-extension/2021-05-25-1.yaml · Note
• https://github.com/klaviyo/magento2-klaviyo · Note
• https://github.com/klaviyo/magento2-klaviyo/pull/107 · Note
• https://gist.github.com/JeroenBoersma/f5864a45e3df63b198a57abdff366df2 · Note