Vulnerabilities

TI-2024-34079 CVE-2024-50677 · GHSA-6hm2-gx4w-jp78

A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0059 Published 2024-12-06 No fix listed CWE-79

TI-2023-26159 CVE-2023-48296 · GHSA-v7px-46v9-5qwp

OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

LOW 20

OroPlatform is a PHP Business Application Platform (BAP).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0044 Published 2024-03-25 Fixed in 5.1.4 CWE-200

TI-2023-24584 CVE-2023-45824 · GHSA-vxq2-p937-3px3

OroPlatform's pinned entity creation form shows pages of other users

LOW 20

OroPlatform is a PHP Business Application Platform (BAP).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0044 Published 2024-03-25 Fixed in 5.1.4 CWE-200

TI-2023-15366 CVE-2023-32062 · GHSA-x2xm-p6vq-482g

OroCalendarBundle has incorrect system calendar events visibility

LOW 24

OroPlatform is a package that assists system and user calendar management.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00538 Published 2023-11-27 Fixed in 5.1.1, 5.0.7 CWE-284

TI-2022-20292 CVE-2022-41951 · GHSA-9v3j-4j64-p937

OroPlatform vulnerable to path traversal during temporary file manipulations

MEDIUM 44

OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00946 Published 2023-11-27 Fixed in 5.0.9, 5.0.8 CWE-22

TI-2021-19658 CVE-2021-43852 · GHSA-jx5q-g37m-h5hj

JavaScript Prototype Pollution in oro/platform

MEDIUM 40

OroPlatform is a PHP Business Application Platform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0113 Published 2022-01-04 Fixed in 4.2.8, 4.1.14 CWE-74

TI-2021-18073 CVE-2021-41236 · GHSA-qv7g-j98v-8pp7

XSS vulnerability in oro/platform

LOW 32