Description
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oroinc | crm | >= 4.2.0, <= 4.2.6, >= 5.0.0, <= 5.0.6, >= 5.1.0, < 5.1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | oro/calendar-bundle | >= 4.2.0, <= 4.2.6 | — | GHSA-x2xm-p6vq-482g |
| Packagist | oro/calendar-bundle | >= 5.0.0, < 5.0.7 | 5.0.7 | GHSA-x2xm-p6vq-482g |
| Packagist | oro/calendar-bundle | >= 5.1.0, < 5.1.1 | 5.1.1 | GHSA-x2xm-p6vq-482g |