GHSA-hvgw-gg3p-295j
Read private customer data reclaiming carts in Klaviyo Magento
GHSA-hvgw-gg3p-295j is a vulnerability with no CVSS score yet in klaviyo/magento2-extension, published May 15, 2024. No source lists public exploit code. Fixed in klaviyo/magento2-extension 3.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.0klaviyo/magento2-extension +1 more
Description
A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
klaviyo/magento2-extensionPackagist | 1.0.0 up to 3.0.0 | 3.0.0 |
klaviyo/magento2-extensionPackagist | 1.0.0 up to 3.0.0, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 25 moreShow less1.0.61.0.71.0.81.0.91.1.01.1.11.1.101.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.21.2.31.2.42.0.02.1.02.1.12.2.02.2.0-patch | 3.0.0 |
What each source reports
GitHub AdvisoriesNo score
Read private customer data reclaiming carts in Klaviyo Magento
A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.
- Record
GHSA-hvgw-gg3p-295j- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
Read private customer data reclaiming carts in Klaviyo Magento
A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.
- Record
GHSA-hvgw-gg3p-295j- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.