EUVD-2026-159562

fkie_cve-2023-45824

OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4.

GHSA-vxq2-p937-3px3 — Pinned entity creation form shows wrong data

Affected: Packagist: oro/platform

### Impact

Logged in user can access page state data of pinned pages of other users by pageId hash.

### Patch

```patch --- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); } ```

Most recent entries from all

EUVD-2026-159562

fkie_cve-2023-45824

GHSA-vxq2-p937-3px3 — Pinned entity creation form shows wrong data

gsd-2023-45824