CVE-2023-45824: Pinned entity creation form shows wrong data

March 25, 2024

Logged in user can access page state data of pinned pages of other users by pageId hash.

References

github.com/advisories/GHSA-vxq2-p937-3px3
github.com/oroinc/platform
github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd
github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3
nvd.nist.gov/vuln/detail/CVE-2023-45824

Code Behaviors & Features

Detect and mitigate CVE-2023-45824 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →