VDB
Sign up
MEDIUM4.3

GHSA-v7px-46v9-5qwp

Storefront user can access history and most viewed data from matching back-office user with the same ID

Quick fix

GHSA-v7px-46v9-5qwp — oro/customer-portal: upgrade to the fixed version with the command below.

composer require oro/customer-portal:^5.1.4

Details

### Impact

Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/oro/customer-portal
Introduced in: 4.1.0

No fixed version published yet for oro/customer-portal (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/customer-portal
Introduced in: 4.2.0

No fixed version published yet for oro/customer-portal (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/customer-portal
Introduced in: 5.0.0

No fixed version published yet for oro/customer-portal (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/customer-portal
Introduced in: 5.1.0Fixed in: 5.1.4
Fixcomposer require oro/customer-portal:^5.1.4

References