Lucene search

GitHub_MVULNRICHMENT:CVE-2023-45824

HistoryMar 25, 2024 - 6:15 p.m.

CVE-2023-45824 OroPlatform's pinned entity creation form shows pages of other users

2024-03-2518:15:32

CWE-200

GitHub_M

github.com

oroplatform

php

business application platform

vulnerability

fixed

user accessing

pinned pages

cve-2023-45824

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.

References

github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd

github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-45824