GHSA-3vhm-q4w3-rw8q: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-3vhm-q4w3-rw8q) in OroPlatform, discovered in July 2015, is an open redirect vulnerability that could allow attackers to redirect users to external websites. The issue affects OroPlatform versions 1.7.0 through 1.7.4, impacting both OroCRM and OroPlatform installations (Oro Blog).

The vulnerability is classified as a moderate severity issue with a CVSS v3.1 score of 6.1. The attack vector is network-based, with low attack complexity and requires no privileges, though it does need user interaction. The vulnerability has a changed scope impact with low confidentiality and integrity impacts, and no availability impact (GitHub Advisory).

If exploited, this vulnerability could allow attackers to perform forced redirects of users to external websites, potentially enabling phishing attacks or other malicious redirections (GitHub Advisory).

The vulnerability requires user interaction to be exploited, with network-based attack vector and low attack complexity. There were no confirmed reports of attacks related to this issue at the time of disclosure (Oro Blog).

Users of OroCRM Enterprise Edition were advised to upgrade to version 1.9.3, while Community Edition users were recommended to upgrade to OroPlatform and OroCRM version CE 1.7.4. B2B SaaS Enterprise customers required no action as the engineering team addressed the issue on their behalf (Oro Blog).