{"id":"GHSA-hvgw-gg3p-295j","aliases":[],"title":"Read private customer data reclaiming carts in Klaviyo Magento","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API.\n\n","severity":"medium","score":null,"published":"2024-05-15T22:03:47.000Z","modified":"2024-11-29T05:40:37.431Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"klaviyo/magento2-extension","sources":[{"name":"OSV · GHSA-hvgw-gg3p-295j","url":"https://osv.dev/vulnerability/GHSA-hvgw-gg3p-295j"}],"ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"3.0.0"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","2.0.0","2.1.0","2.1.1","2.2.0","2.2.0-patch"],"fixed":["3.0.0"]}],"sourceAffected":[],"references":["https://github.com/klaviyo/magento2-klaviyo/pull/107","https://gist.github.com/JeroenBoersma/f5864a45e3df63b198a57abdff366df2","https://github.com/FriendsOfPHP/security-advisories/blob/master/klaviyo/magento2-extension/2021-05-25-1.yaml","https://github.com/klaviyo/magento2-klaviyo"],"sources":[{"name":"OSV","id":"GHSA-hvgw-gg3p-295j","modified":"2024-11-29T05:40:37.431105Z","url":"https://osv.dev/vulnerability/GHSA-hvgw-gg3p-295j"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T13:40:31.265Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}