CVE-2023-32063CWE-284

OroCRMCallBundle has incorrect call view page visibility

Medium · published November 28, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-11-28T03:30Z
EPSS history
Timeline
  • 28 NOV 03:30Z
    OroCRMCallBundle has incorrect call view page visibility
    cvelistv5