medium4.3
CVE-2023-48296
Storefront user can access history and most viewed data from matching back-office user with the same ID
Impact
### Impact Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/customer-portal | >= 4.1.0, <= 4.1.13 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Oroplatform | from 4.1.0 before 5.1.4 |