Vulnerability · Published Nov 27, 2023 · Assigned by GitHub_M
CVE-2023-32062OroCalendarBundle has incorrect system calendar events visibility
Medium 5.0
In plain English
A medium-severity improper access control in crm from oroinc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | oro/calendar-bundle | no fix listed | GHSA-x2xm-p6vq-482g |
| Packagist | oro/calendar-bundle | 5.0.7 | GHSA-x2xm-p6vq-482g |
| Packagist | oro/calendar-bundle | 5.1.1 | GHSA-x2xm-p6vq-482g |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g x_refsource_CONFIRM
- https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b x_refsource_MISC
- https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531 x_refsource_MISC