CVE-2023-45824

Description

### Impact Logged in user can access page state data of pinned pages of other users by pageId hash. ### Patch ```patch --- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); } ```

How to fix CVE-2023-45824

To remediate CVE-2023-45824, upgrade the affected package to a fixed version below.

• —upgrade to 5.1.4 or later

Is CVE-2023-45824 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 5.1.0, < 5.1.4

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-45824
• PATCHgithub.com/oroinc/platform
• WEBgithub.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd
• WEBgithub.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3