CVE-2023-32062CWE-284

OroCalendarBundle has incorrect system calendar events visibility

Medium · published November 27, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-11-27T20:58Z
EPSS history
Timeline
  • 27 NOV 20:58Z
    OroCalendarBundle has incorrect system calendar events visibility
    cvelistv5