| Assigner | INCIBE |
| Reserved | 2024-07-04 |
| Published | 2024-07-04 |
| Updated | 2024-07-04 |
Description
Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L |
Problem types
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Product status
5.4.3
Credits
Jesús Higueras
References
https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug
