Skip to content

Pinned entity creation form shows wrong data

Moderate
dkhrysev published GHSA-vxq2-p937-3px3 Mar 25, 2024

Package

composer oro/platform (Composer)

Affected versions

>=4.2.0, <=4.2.10 || >=5.0.0, <=5.0.12 || >=5.1.0, <=5.1.3

Patched versions

5.1.4

Description

Impact

Logged in user can access page state data of pinned pages of other users by pageId hash.

Patch

--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
+++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
@@ -158,6 +158,13 @@
             AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId'))
         );
 
+        if ($entity) {
+            $entity = $this->getEntity($entity->getId());
+        }
+        if (!$entity) {
+            return $this->handleNotFound();
+        }
+
         return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK));
     }
 

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE ID

CVE-2023-45824

Weaknesses

No CWEs