VDB
Sign up
MEDIUM4.3

GHSA-vxq2-p937-3px3

Pinned entity creation form shows wrong data

Quick fix

GHSA-vxq2-p937-3px3 — oro/platform: upgrade to the fixed version with the command below.

composer require oro/platform:^5.1.4

Details

### Impact

Logged in user can access page state data of pinned pages of other users by pageId hash.

### Patch

```patch --- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); } ```

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/oro/platform
Introduced in: 5.1.0Fixed in: 5.1.4
Fixcomposer require oro/platform:^5.1.4
Packagist/oro/platform
Introduced in: 5.0.0

No fixed version published yet for oro/platform (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/platform
Introduced in: 4.2.0

No fixed version published yet for oro/platform (composer). Pin to a known-safe version or switch to an alternative.

References