CVE-2023-48296

OroPlatform is a PHP Business Application Platform (BAP).  Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
oroincoroplatform
4.1.0 ≤
𝑥
< 5.1.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8
https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp
https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8
https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp