CVE-2023-48296: OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-25 · updated 2026-06-17
Weakness: CWE-200

Description

OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

Affected products

oroinc platform: from 4.1.0 before 5.1.4 — fixed in 5.1.4

How to fix

Upgrade to a fixed version: oroinc platform 5.1.4. Check the vendor advisory for mitigations.

References

https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8
https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp
https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8
https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp

Get alerted when CVE-2023-48296 or the next vulnerability affects your stack