medium4.3
CVE-2023-45824
Pinned entity creation form shows wrong data
Impact
### Impact Logged in user can access page state data of pinned pages of other users by pageId hash. ### Patch ```patch --- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); } ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/platform | >= 5.1.0, <= 5.1.3 | 5.1.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Oroplatform | from 4.2.0 before 5.1.4 |