CVE-2023-32063 (published 2023-11-28T03:30:22.578Z)
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
Affected products: Vendor: oroinc
Product: crm
Versions: >= 4.2.0, <= 4.2.5, >= 5.0.0, < 5.0.4, >= 5.1.0, < 5.1.1