Description
OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oroinc | platform | >=4.2.0, <=4.2.10, >=5.0.0, <=5.0.12, >= 5.1.0, <= 5.1.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | oro/platform | >= 5.1.0, < 5.1.4 | 5.1.4 | GHSA-vxq2-p937-3px3 |
| Packagist | oro/platform | >= 5.0.0, <= 5.0.12 | — | GHSA-vxq2-p937-3px3 |
| Packagist | oro/platform | >= 4.2.0, <= 4.2.10 | — | GHSA-vxq2-p937-3px3 |