p PatchFirst

CVE-2023-48296

CVE-2023-48296 · OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

CVSS 4.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • orocommerce

    Versions
    • >=4.1.0, <=4.1.13: Affected
    • >=4.2.0, <=4.2.10: Affected
    • >=5.0.0, <=5.0.11: Affected
    • >=5.1.0, <=5.1.3: Affected

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 4.1.0
    • 4.1.1
    • 4.1.1-rc
    • 4.1.1-rc2
    • 4.1.10
    • 4.1.11
    • 4.1.12
    • 4.1.13
    • 4.1.2
    • 4.1.3
    • 4.1.4
    • 4.1.5
    • 4.1.6
    • 4.1.7
    • 4.1.8
    • 4.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 4.1.0, ≤ 4.1.13

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 4.2.0
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.2.4
    • 4.2.5
    • 4.2.6
    • 4.2.7
    • 4.2.8
    Affected ranges
    • ECOSYSTEM: ≥ 4.2.0, ≤ 4.2.10

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.10
    • 5.0.11
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 5.0.8
    • 5.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, ≤ 5.0.11

    No fix published

  • oro/customer-portal Packagist

    Versions
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.1.3
    Affected ranges
    • ECOSYSTEM: ≥ 5.1.0, < 5.1.4

    Update to 5.1.4

Original sources

Check your server →