{"id":"CVE-2024-13257","aliases":["DRUPAL-CONTRIB-2024-021","EUVD-2024-51471","GHSA-932w-6jv2-mm8q"],"status":"published","title":"Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00293,"percentile":0.22129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-05-22T16:21:55Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_view_receipt","fixed_in":["1.0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_view_receipt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]}],"products":[{"vendor":"commerce_view_receipt_project","product":"commerce_view_receipt"},{"vendor":"drupal","product":"commerce view receipt"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-021","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13257","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-932w-6jv2-mm8q"},{"url":"https://git.drupalcode.org/project/commerce_view_receipt","tags":["web"]},{"url":"https://www.drupal.org/project/commerce_view_receipt","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13257.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13257","title":"Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","status":"published","published":"2025-01-09T19:04:57.424Z","modified":"2025-01-10T16:50:24.727Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51471","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","status":"published","published":"2025-01-09T19:04:57Z","modified":"2025-01-10T16:50:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-932w-6jv2-mm8q","title":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing...","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13257","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","status":"published","published":"2025-01-09T19:15:19.773Z","modified":"2026-06-17T07:01:36.33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13257","title":"Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021","description":"Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.","status":"published","published":"2025-01-09T19:04:57.424Z","modified":"2026-10-28T02:30:34.467958313Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-021","description":"The Commerce View Receipts module enables you to view commerce order receipts in the browser.\n\nThe module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers.","status":"published","published":"2024-05-22T16:21:55Z","modified":"2026-09-10T03:45:29.70508312Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}