CVE-2023-45824: 
PHP vulnerability analysis and mitigation

OroPlatform, a PHP Business Application Platform (BAP), was found to contain a security vulnerability identified as CVE-2023-45824. The vulnerability allows a logged-in user to access page state data of pinned pages belonging to other users by using a pageId hash. This security issue was discovered and disclosed on March 25, 2024, affecting versions >=4.2.0, <=4.2.10 || >=5.0.0, <=5.0.12 || >=5.1.0, <=5.1.3 of the platform. The vulnerability has been fixed in version 5.1.4 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This scoring indicates that the vulnerability requires network access and low privileges to exploit, requires no user interaction, has unchanged scope, and impacts only confidentiality at a low level, with no impact on integrity or availability (GitHub Advisory).

The vulnerability allows authenticated users to access sensitive page state data belonging to other users' pinned pages, resulting in a potential information disclosure issue. The impact is primarily focused on confidentiality, with no direct effects on system integrity or availability (GitHub Advisory).

The vulnerability can be exploited by a logged-in user with low privileges over the network. The attack complexity is low, and no user interaction is required for exploitation. The attacker needs to have access to the pageId hash to exploit this vulnerability (GitHub Advisory).

The vulnerability has been patched in OroPlatform version 5.1.4. Users are advised to upgrade to this version or later to address the security issue. The fix involves additional validation checks in the PagestateController.php file to prevent unauthorized access to page state data (GitHub Advisory).