MEDIUM5.0

GHSA-x2xm-p6vq-482g

OroCalendarBundle has incorrect system calendar events visibility

Quick fix

GHSA-x2xm-p6vq-482g — oro/calendar-bundle: upgrade to the fixed version with the command below.

composer require oro/calendar-bundle:^5.0.7

Details

OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/oro/calendar-bundle

Introduced in: 4.2.0

No fixed version published yet for oro/calendar-bundle (composer). Pin to a known-safe version or switch to an alternative.

Packagist/oro/calendar-bundle

Introduced in: 5.0.0Fixed in: 5.0.7

Fixcomposer require oro/calendar-bundle:^5.0.7

Packagist/oro/calendar-bundle

Introduced in: 5.1.0Fixed in: 5.1.1

Fixcomposer require oro/calendar-bundle:^5.1.1

References

https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-32062[ADVISORY]
https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b[WEB]
https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531[WEB]
https://github.com/oroinc/crm[PACKAGE]