Incorrect system calendar events visibility

Moderate

dkhrysev published GHSA-x2xm-p6vq-482g

Nov 27, 2023

Package

oro/calendar-bundle (Composer)

Affected versions

>=4.2.0, <=4.2.6 || >=5.0.0, <=5.0.6 || >=5.1.0, <5.1.1

Patched versions

5.1.1, 5.0.7

Description

Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks.

Severity

Moderate

5.0

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N