Project: 
Commerce Core
Date: 
2021-September-22
Security risk: 
Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass, Information Disclosure
Affected versions: 
<2.27.0
Description: 

This module provides a system for building an ecommerce solution in their Drupal site.

The module doesn't sufficiently verify access to profile data in certain circumstances.

This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: