Vulnerability · Published Nov 28, 2023 · Assigned by GitHub_M
CVE-2023-32063OroCRMCallBundle has incorrect call view page visibility
Medium 5.0
In plain English
A medium-severity improper access control in crm from oroinc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | oro/crm-call-bundle | no fix listed | GHSA-897w-jv7j-6r7g |
| Packagist | oro/crm-call-bundle | 5.0.4 | GHSA-897w-jv7j-6r7g |
| Packagist | oro/crm-call-bundle | 5.1.1 | GHSA-897w-jv7j-6r7g |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g x_refsource_CONFIRM
- https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85 x_refsource_MISC
- https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950 x_refsource_MISC