{"id":"GHSA-vxq2-p937-3px3","aliases":["CVE-2023-45824"],"title":"Pinned entity creation form shows wrong data","description":"### Impact\n\nLogged in user can access page state data of pinned pages of other users by pageId hash.\n\n\n### Patch\n\n```patch\n--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php\n+++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php\n@@ -158,6 +158,13 @@\n             AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId'))\n         );\n \n+        if ($entity) {\n+            $entity = $this->getEntity($entity->getId());\n+        }\n+        if (!$entity) {\n+            return $this->handleNotFound();\n+        }\n+\n         return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK));\n     }\n \n```","severity":"medium","score":4.3,"published":"2024-03-25T19:39:21.000Z","modified":"2026-09-10T03:50:10.776Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"oro/platform","ranges":[{"events":[{"introduced":"5.1.0"},{"fixed":"5.1.4"}],"type":"ECOSYSTEM"}],"versions":["5.1.0","5.1.1","5.1.2","5.1.3"],"fixed":["5.1.4"]},{"ecosystem":"Packagist","name":"oro/platform","ranges":[{"events":[{"introduced":"5.0.0"},{"last_affected":"5.0.12"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"fixed":[]},{"ecosystem":"Packagist","name":"oro/platform","ranges":[{"events":[{"introduced":"4.2.0"},{"last_affected":"4.2.10"}],"type":"ECOSYSTEM"}],"versions":["4.2.0","4.2.1","4.2.10","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"],"fixed":[]}],"references":["https://github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3","https://nvd.nist.gov/vuln/detail/CVE-2023-45824","https://github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd","https://github.com/oroinc/platform"],"sources":[{"name":"OSV","id":"GHSA-vxq2-p937-3px3","modified":"2026-09-10T03:50:10.776612220Z","url":"https://osv.dev/vulnerability/GHSA-vxq2-p937-3px3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}]}