{"id":"GHSA-hvgw-gg3p-295j","aliases":[],"status":"published","title":"Read private customer data reclaiming carts in Klaviyo Magento","description":"A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-05-15T22:03:47Z","modified":"2024-11-29T05:40:37Z","fixes":[{"ecosystem":"Packagist","package":"klaviyo/magento2-extension","fixed_in":["3.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"klaviyo/magento2-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"klaviyo/magento2-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.0.0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","2.0.0","2.1.0","2.1.1","2.2.0","2.2.0-patch"]}],"references":[{"url":"https://github.com/klaviyo/magento2-klaviyo/pull/107","tags":["web"]},{"url":"https://gist.github.com/JeroenBoersma/f5864a45e3df63b198a57abdff366df2","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/klaviyo/magento2-extension/2021-05-25-1.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hvgw-gg3p-295j"},{"url":"https://github.com/klaviyo/magento2-klaviyo","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hvgw-gg3p-295j","title":"Read private customer data reclaiming carts in Klaviyo Magento","description":"A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.\n\n","status":"published","published":"2024-05-15T22:03:47Z","modified":"2024-05-15T22:03:49Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"osv":[{"id":"GHSA-hvgw-gg3p-295j","title":"Read private customer data reclaiming carts in Klaviyo Magento","description":"A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.\n\n","status":"published","published":"2024-05-15T22:03:47Z","modified":"2024-11-29T05:40:37.431105Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}