Threats tagged 'ghsa-7vc5-wfjj-r2px'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an information disclosure vulnerability in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() function. This flaw allows authenticated customers to access internal staff comments, such as fraud-review and payment notes, by opening the /rss/order/status feed for their orders. The vulnerability arises because the is_visible_on_front filter is omitted for invoice, shipment, and credit-memo comments, exposing sensitive internal information.