Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-3vhm-q4w3-rw8q
GHSA-3vhm-q4w3-rw8q:
PHP vulnerability analysis and mitigation
Overview
The vulnerability (GHSA-3vhm-q4w3-rw8q) in OroPlatform, discovered in July 2015, is an open redirect vulnerability that could allow attackers to redirect users to external websites. The issue affects OroPlatform versions 1.7.0 through 1.7.4, impacting both OroCRM and OroPlatform installations (Oro Blog).
Technical details
The vulnerability is classified as a moderate severity issue with a CVSS v3.1 score of 6.1. The attack vector is network-based, with low attack complexity and requires no privileges, though it does need user interaction. The vulnerability has a changed scope impact with low confidentiality and integrity impacts, and no availability impact (GitHub Advisory).
Impact
If exploited, this vulnerability could allow attackers to perform forced redirects of users to external websites, potentially enabling phishing attacks or other malicious redirections (GitHub Advisory).
Mitigation and workarounds
Users of OroCRM Enterprise Edition were advised to upgrade to version 1.9.3, while Community Edition users were recommended to upgrade to OroPlatform and OroCRM version CE 1.7.4. B2B SaaS Enterprise customers required no action as the engineering team addressed the issue on their behalf (Oro Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management