1. Home
  2. CVE Database
  3. CVE-2023-48296
MEDIUM · 4.3

CVE-2023-48296

OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront...

Vulnerability Description

OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
OroincOroplatform>= 4.1.0, < 5.1.4

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2023-48296?

CVE-2023-48296 is a vulnerability with a CVSS score of 4.3 (MEDIUM). OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront...

How severe is CVE-2023-48296?

CVE-2023-48296 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-48296?

Check the references section above for vendor advisories and patch information. Affected products include: Oroinc Oroplatform.