Configured Commerce vulnerabilities
4 known vulnerabilities in Configured Commerce from Optimizely. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Configured Commerce: Use of HTTP Request With Sensitive Query String
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be
- 7.3 High severity
An issue was discovered in Optimizely Configured Commerce before 5.2.2408.
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessi
- 7.5 High severity
Configured Commerce: External Control of Assumed-Immutable Web Parameter
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where
- 8.1 High severity
Configured Commerce: Improper Neutralization of Input During Web Page Generation
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.