Information disclosure in Oroinc Orocommerce
CVE-2023-48296
OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.
Vulnerability class: Information Disclosure
EPSS: 0.004 (36.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Oroinc Orocommerce — versions >=4.1.0, <=4.1.13, >=4.2.0, <=4.2.10, >=5.0.0, <=5.0.11
- Oroinc Oroplatform
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-48296?
- CVE-2023-48296 is a medium-severity vulnerability in Oroinc Orocommerce, classified under Information Disclosure. CVSS score: 4.3/10. Published 2024-03-25.
- How severe is CVE-2023-48296?
- Medium severity. CVSS v3 base score is 4.3 out of 10.