drupal/commerce - SA-CONTRIB-2020-020
Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never assigned an owner.
When anonymous users are granted the "View own orders" permission, they are able to see any such anonymous order via direct navigation to its view page. The module does not include extra access control necessary to ensure anonymous users are only able to view their own previously placed orders.
This vulnerability is mitigated by the fact that a site must be configured to permit anonymous checkout and an attacker must be an anonymous user with the permission "View own orders".
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/commerce | < 2.18.0 | 2.18.0 |
| Drupal module | drupal/commerce | < 2.18.0 | 2.18.0 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/commerce- Disclosed
- 27.05.2020
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2020-020 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/commerce
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 08.2018 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Unrated 4
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
drupal/commerce - SA-CONTRIB-2020-020 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.