CVE-2023-32062
OroCalendarBundle has incorrect system calendar events visibility
Résumé
OroCalendarBundle has incorrect system calendar events visibility
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com