GHSA-vxq2-p937-3px3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vxq2-p937-3px3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-vxq2-p937-3px3/GHSA-vxq2-p937-3px3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vxq2-p937-3px3
- Aliases
- Published
- 2024-03-25T19:39:21Z
- Modified
- 2024-03-25T22:31:16.616196Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Pinned entity creation form shows wrong data
- Details
-
Impact
Logged in user can access page state data of pinned pages of other users by pageId hash.
Patch
--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); } - Database specific
{ "nvd_published_at": "2024-03-25T19:15:57Z", "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:39:21Z" }- References
Affected packages
Packagist / oro/platform
Package
- Name
- oro/platform
- Purl
- pkg:composer/oro/platform
Packagist / oro/platform
Package
- Name
- oro/platform
- Purl
- pkg:composer/oro/platform
Packagist / oro/platform
Package
- Name
- oro/platform
- Purl
- pkg:composer/oro/platform