CVE-2024-6506

Published: Jul 4, 2024Modified: Jun 17, 2026Deferred

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Exploitability: 3.9 / Impact: 4.2

Source: cve-coordination@incibe.es (Secondary)

Description

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug

Source: cve-coordination@incibe.es

https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.