GitHub Advisoryadvisory · Packagist

GHSA-v7px-46v9-5qwp Storefront user can access history and most viewed data from matching back-office user with the same ID

MEDIUM Published 2024-03-25 Modified 2024-03-25 Official page ↗
Aliases
CVE-2023-48296
Ecosystem
Packagist
Packages
oro/customer-portal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-03-25

Affected packages

• Packagist oro/customer-portal: >= 4.1.0, <= 4.1.13 (no fix yet) • Packagist oro/customer-portal: >= 4.2.0, <= 4.2.10 (no fix yet) • Packagist oro/customer-portal: >= 5.0.0, <= 5.0.11 (no fix yet) • Packagist oro/customer-portal: >= 5.1.0, < 5.1.4 → fixed in 5.1.4

Description

Impact Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.

Related

Alias · CVE (1)

  • CVE-2023-48296 OroPlatform is a PHP Business Application Platform (BAP). vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References