CVE-2023-32063
OroCRMCallBundle has incorrect call view page visibility
Résumé
OroCRMCallBundle has incorrect call view page visibility
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com