GHSA-v7px-46v9-5qwpMediumCVSS 4.3

Storefront user can access history and most viewed data from matching back-office user with the same ID

Published
March 25, 2024
Last Modified
March 25, 2024

🔗 CVE IDs covered (1)

CVE-2023-48296 →

📋 Description

Impact

Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.

🎯 Affected products4

  • composer/oro/customer-portal:>= 4.1.0, <= 4.1.13
  • composer/oro/customer-portal:>= 4.2.0, <= 4.2.10
  • composer/oro/customer-portal:>= 5.0.0, <= 5.0.11
  • composer/oro/customer-portal:>= 5.1.0, <= 5.1.3

🔗 References (4)