CVE-2023-32063

Published November 28th, 2023

View on NVD ↗

CVSS v3

MEDIUM

CVSS v2

N/A

Affected

PROJECTS

Description

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

oroinc/crm

Main OroCRM package with core functionality.

GitHub

680

oroinc/OroCRMCallBundle

OroPlatform package, enables calls management.

GitHub