Lucene search

GoogleOSV:GHSA-X2XM-P6VQ-482G

HistoryNov 27, 2023 - 11:29 p.m.

OroCalendarBundle has incorrect system calendar events visibility

2023-11-2723:29:11

Google

osv.dev

orocalendarbundle

system calendar

events

visibility

oroplatform

package

calendar management

security

back-office users

acl

security restrictions

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

21.6%

JSON

OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks.

CPENameOperatorVersion
oro/calendar-bundleeq4.2.2
oro/calendar-bundleeq4.2.6
oro/calendar-bundleeq5.1.0
oro/calendar-bundleeq4.2.4
oro/calendar-bundleeq4.2.3
oro/calendar-bundleeq4.2.0
oro/calendar-bundleeq5.0.0
oro/calendar-bundleeq5.0.1
oro/calendar-bundleeq5.0.2
oro/calendar-bundleeq5.0.4

Name	Operator	Version
oro/calendar-bundle	eq	4.2.2
oro/calendar-bundle	eq	4.2.6
oro/calendar-bundle	eq	5.1.0
oro/calendar-bundle	eq	4.2.4
oro/calendar-bundle	eq	4.2.3
oro/calendar-bundle	eq	4.2.0
oro/calendar-bundle	eq	5.0.0
oro/calendar-bundle	eq	5.0.1
oro/calendar-bundle	eq	5.0.2
oro/calendar-bundle	eq	5.0.4

Rows per page:

1-10 of 151

References

github.com/oroinc/crm

github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g

github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b

github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531

nvd.nist.gov/vuln/detail/CVE-2023-32062

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for OSV:GHSA-X2XM-P6VQ-482G