CVE-2023-45824 OroPlatform's pinned entity creation form shows pages of other users
A logged-in user can access other users' pinned page state data via pageId hash, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45824?
CVE-2023-45824 is a medium-severity vulnerability in oroinc platform, published on 25 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.
Weakness: CWE-200
Which versions are affected by CVE-2023-45824?
6 open source packages ship an affected version, including oro/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oro/platform Packagist | From 4.2.0 to 4.2.10 | None |
oro/platform Packagist | From 4.2.0 to 4.2.10 | None |
oro/platform Packagist | From 5.0.0 to 5.0.12 | None |
oro/platform Packagist | From 5.0.0 to 5.0.12 | None |
oro/platform Packagist | From 5.1.0 | 5.1.4 |
oro/platform Packagist | From 5.1.0 | 5.1.4 |
Products include Oroinc Oroplatform.
How do I fix CVE-2023-45824?
Upgrade oro/platform to 5.1.4 or later.
Is CVE-2023-45824 being exploited?
There is no known exploitation of CVE-2023-45824 in the wild and no public exploit code.
Other vulnerabilities in oroinc platform
- CVE-2021-43852 JavaScript Prototype Pollution in oro/platform
- CVE-2022-41951 OroPlatform vulnerable to path traversal during temporary file manipulations
- CVE-2021-41236 XSS vulnerability in oro/platform
- CVE-2024-50677 Cross-site scripting in n/a
- CVE-2023-32062 OroCalendarBundle has incorrect system calendar events visibility
Sources
Also known as GHSA-vxq2-p937-3px3.