Skip to content
OpenAdvisories

Product · oroinc

crm

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.0
    CVE-2023-32063

    OroCRMCallBundle has incorrect call view page visibility

    OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in v…

    oroinc crm oro/crm-call-bundle Packagist
  • Medium 5.0
    CVE-2023-32062

    OroCalendarBundle has incorrect system calendar events visibility

    OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in…

    oroinc crm oro/calendar-bundle Packagist
  • Medium 4.2
    CVE-2021-39198

    The disqualify lead action may be executed without CSRF token check

    OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workaroun…

    oroinc crm oro/crm Packagist