CVE-2023-45824

MEDIUM

OroPlatform 4.2.0-5.1.3 - Authenticated Exposure of Sensitive Information via Pinned Page State

Title source: llm

Description

OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

https://github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3

Product x_refsource_misc

https://github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd

View Writeup ZIP pw:eip

Scores

CVSS v3 4.3

EPSS 0.0044

EPSS Percentile 35.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

oro/platform 5.1.0 - 5.1.4Packagist

oroinc/oroplatform 4.2.0 - 5.1.4

Published Mar 25, 2024

Tracked Since Feb 18, 2026