CVE-2023-32063 - OpenCVE

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Oroinc	Client Relationship Management

Configuration 1 [-]

OR	cpe:2.3:a:oroinc:client_relationship_management::::::::
	cpe:2.3:a:oroinc:client_relationship_management::::::::
	cpe:2.3:a:oroinc:client_relationship_management::::::::

No data.

References

Link	Providers
https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85
https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950
https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-11-28T03:30:22.578Z

Updated: 2024-08-02T15:03:28.874Z

Reserved: 2023-05-01T16:47:35.314Z

Link: CVE-2023-32063

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-11-28T04:15:07.143

Modified: 2023-12-01T21:46:28.420

Link: CVE-2023-32063

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32063", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-01T16:47:35.314Z", "datePublished": "2023-11-28T03:30:22.578Z", "dateUpdated": "2024-08-02T15:03:28.874Z"}, "containers": {"cna": {"title": "OroCRMCallBundle has incorrect call view page visibility", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85", "tags": ["x_refsource_MISC"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950", "tags": ["x_refsource_MISC"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}], "affected": [{"vendor": "oroinc", "product": "crm", "versions": [{"version": ">= 4.2.0, <= 4.2.5", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.4", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-11-28T03:30:22.578Z"}, "descriptions": [{"lang": "en", "value": "OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1."}], "source": {"advisory": "GHSA-897w-jv7j-6r7g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:28.874Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7A1B563-4905-464D-A4B0-A317A2182BA2", "versionEndIncluding": "4.2.5", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A2D401C-A6CD-48B0-8A5C-A9FD55182189", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "E55AC63D-454C-48E3-8FD5-E8521E9554A2", "versionEndExcluding": "5.1.1", "versionStartIncluding": "5.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1."}, {"lang": "es", "value": "OroCalendarBundle habilita una funci\u00f3n de Calendario y funciones relacionadas en aplicaciones Oro. Los usuarios del back-office pueden acceder a la informaci\u00f3n de cualquier evento de llamada, evitando las restricciones de seguridad de ACL debido a controles de seguridad insuficientes. Este problema se solucion\u00f3 en las versiones 5.0.4 y 5.1.1."}], "id": "CVE-2023-32063", "lastModified": "2023-12-01T21:46:28.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-11-28T04:15:07.143", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}]}