{"action":"Upgrade oro/customer-portal to 5.1.4 or later.","affected":[{"introduced":"4.1.0","last_affected":"4.1.13"},{"introduced":"4.2.0","last_affected":"4.2.10"},{"introduced":"5.0.0","last_affected":"5.0.11"},{"fixed":"5.1.4","introduced":"5.1.0"}],"component":"oro/customer-portal","cve_ids":["CVE-2023-48296"],"ecosystem":"Packagist","epss":0.0044,"exploited":false,"fixed_versions":["5.1.4"],"ghsa_id":"GHSA-v7px-46v9-5qwp","id":"tcs_01M5KF8YCHX2H0PPJB814MY9HZ","modified_at":"2026-09-10T03:50:10.816050821Z","published_at":"2024-03-25T19:43:06Z","references":["https://osv.dev/vulnerability/GHSA-v7px-46v9-5qwp","https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp","https://nvd.nist.gov/vuln/detail/CVE-2023-48296","https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8","https://github.com/oroinc/orocommerce"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-v7px-46v9-5qwp","url":"https://osv.dev/vulnerability/GHSA-v7px-46v9-5qwp"}],"summary":"Storefront user can access history and most viewed data from matching back-office user with the same ID"}