GHSA-v7px-46v9-5qwp
Storefront user can access history and most viewed data from matching back-office user with the same ID
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | oro/customer-portal | >= 4.1.0, <= 4.1.13 | no fix listed |
| Packagist | oro/customer-portal | >= 4.2.0, <= 4.2.10 | no fix listed |
| Packagist | oro/customer-portal | >= 5.0.0, <= 5.0.11 | no fix listed |
| Packagist | oro/customer-portal | >= 5.1.0, < 5.1.4 | 5.1.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.
References
External links from the advisory. They lead to third-party sites.