Security feature bypass

2023-11-2804:15:00

PRIOn knowledge base

www.prio-n.com

orocalendarbundle

security feature

bypass

acl

back-office

patch

version 5.0.4

version 5.1.1

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

21.6%

JSON

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

CPENameOperatorVersion
client_relationship_managementge4.2.0
client_relationship_managementle4.2.5
client_relationship_managementge5.1.0
client_relationship_managementlt5.1.1
client_relationship_managementge5.0.0
client_relationship_managementlt5.0.4

Name	Operator	Version
client_relationship_management	ge	4.2.0
client_relationship_management	le	4.2.5
client_relationship_management	ge	5.1.0
client_relationship_management	lt	5.1.1
client_relationship_management	ge	5.0.0
client_relationship_management	lt	5.0.4