CVE-2023-32063 - Vulnerability Details - OpenCVE

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00195.

Key SSVC decision points have not yet been added.

Vendors	Products
Oroinc	Client Relationship Management

Configuration 1 [-]

OR	cpe:2.3:a:oroinc:client_relationship_management::::::::
	cpe:2.3:a:oroinc:client_relationship_management::::::::
	cpe:2.3:a:oroinc:client_relationship_management::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-2919	OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Github GHSA	GHSA-897w-jv7j-6r7g	OroCRMCallBundle has incorrect call view page visibility

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85
https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950
https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-11-28T03:30:22.578Z

Updated: 2024-08-02T15:03:28.874Z

Reserved: 2023-05-01T16:47:35.314Z

Link: CVE-2023-32063

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-11-28T04:15:07.143

Modified: 2024-11-21T08:02:38.350

Link: CVE-2023-32063

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32063", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-01T16:47:35.314Z", "datePublished": "2023-11-28T03:30:22.578Z", "dateUpdated": "2024-08-02T15:03:28.874Z"}, "containers": {"cna": {"title": "OroCRMCallBundle has incorrect call view page visibility", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85", "tags": ["x_refsource_MISC"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950", "tags": ["x_refsource_MISC"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}], "affected": [{"vendor": "oroinc", "product": "crm", "versions": [{"version": ">= 4.2.0, <= 4.2.5", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.4", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-11-28T03:30:22.578Z"}, "descriptions": [{"lang": "en", "value": "OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1."}], "source": {"advisory": "GHSA-897w-jv7j-6r7g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:28.874Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"name": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7A1B563-4905-464D-A4B0-A317A2182BA2", "versionEndIncluding": "4.2.5", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A2D401C-A6CD-48B0-8A5C-A9FD55182189", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:client_relationship_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "E55AC63D-454C-48E3-8FD5-E8521E9554A2", "versionEndExcluding": "5.1.1", "versionStartIncluding": "5.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1."}, {"lang": "es", "value": "OroCalendarBundle habilita una funci\u00f3n de Calendario y funciones relacionadas en aplicaciones Oro. Los usuarios del back-office pueden acceder a la informaci\u00f3n de cualquier evento de llamada, evitando las restricciones de seguridad de ACL debido a controles de seguridad insuficientes. Este problema se solucion\u00f3 en las versiones 5.0.4 y 5.1.1."}], "id": "CVE-2023-32063", "lastModified": "2024-11-21T08:02:38.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-28T04:15:07.143", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/456b1dda7762abf4ff59eafffaa70ab7f09d1c85"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/oroinc/OroCRMCallBundle/commit/9a41dff459bb4aff864175ca883d553ac0954950"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/oroinc/crm/security/advisories/GHSA-897w-jv7j-6r7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}