Description
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oroinc | crm | >= 4.2.0, <= 4.2.5, >= 5.0.0, < 5.0.4, >= 5.1.0, < 5.1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | oro/crm-call-bundle | >= 4.2.0, <= 4.2.5 | — | GHSA-897w-jv7j-6r7g |
| Packagist | oro/crm-call-bundle | >= 5.0.0, < 5.0.4 | 5.0.4 | GHSA-897w-jv7j-6r7g |
| Packagist | oro/crm-call-bundle | >= 5.1.0, < 5.1.1 | 5.1.1 | GHSA-897w-jv7j-6r7g |