CVE-2023-45824: Pinned entity creation form shows wrong data in oro/platform
Summary
CVE-2023-45824: Pinned entity creation form shows wrong data. Affects oro/platform across 3 version ranges.
>= 4.2.0, <= 4.2.10
>= 5.0.0, <= 5.0.12
>= 5.1.0, < 5.1.4
Fixed in 5.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oro/platform is an open-source platform that provides a foundation for developing business applications. It offers various features and components for managing entities, navigation, and user interfaces. The platform is widely used in enterprise environments to build robust and scalable applications.
Vulnerability Detail
The vulnerability (CVE-2023-45824) in oro/platform allows a logged-in user to access the page state data of pinned pages belonging to other users. This can be achieved by exploiting the pageId hash. By accessing this data, an attacker can potentially gain unauthorized access to sensitive information or perform actions on behalf of other users. The vulnerability affects versions 4.2.0 to 4.2.10, 5.0.0 to 5.0.12, and 5.1.0 to 5.1.3 of oro/platform.
How To Fix
Minimum fixed version
5.1.4
This is the first release that contains the fix.
composer require oro/platform:5.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patch or update the platform to the latest version to mitigate the risk.
Conclusion
The vulnerability in oro/platform (CVE-2023-45824) allows unauthorized access to page state data of pinned pages. It is crucial to update the platform to version 5.1.4 or later to mitigate the risk. Applying the provided patch or updating the platform ensures the security of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oro/platform →
FAQ
oro/platform is an open-source platform used for developing business applications. It provides various features and components for managing entities, navigation, and user interfaces.
The vulnerability allows a logged-in user to access the page state data of pinned pages belonging to other users. This can lead to unauthorized access to sensitive information or performing actions on behalf of other users.
Versions 4.2.0 to 4.2.10, 5.0.0 to 5.0.12, and 5.1.0 to 5.1.3 of oro/platform are affected by this vulnerability.
To fix this vulnerability, it is recommended to update oro/platform to version 5.1.4 or later. This update includes a patch that addresses the issue.
There is no known workaround for this vulnerability. It is crucial to apply the provided patch or update the platform to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for oro/platform.
