« Volver al listado

CVE-2023-32062

Estado: ModificadaMedia (4.3)—

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oroinc — Oroplatform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-32062",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "oroinc",
          "product": "crm",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.0, <= 4.2.6"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, <= 5.0.6"
            },
            {
              "status": "affected",
              "version": ">= 5.1.0, < 5.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-27T22:15:07.660",
  "references": [
    {
      "url": "https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1."
    },
    {
      "lang": "es",
      "value": "OroPlatform es un paquete que ayuda a la gestión del calendario del usuario y del sistema. Los usuarios del back-office pueden acceder a la información de cualquier evento del calendario del sistema, evitando las restricciones de seguridad de ACL debido a controles de seguridad insuficientes. Esta vulnerabilidad ha sido parcheada en la versión 5.1.1."
    }
  ],
  "lastModified": "2026-06-17T05:57:59.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oroinc:oroplatform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4F4894B-25D0-4CA4-9507-270AA1DB43DF",
              "versionEndIncluding": "4.2.6",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:oroplatform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FF11919-29C5-4E1F-AB3C-2D4B61D0001A",
              "versionEndExcluding": "5.0.7",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:oroinc:oroplatform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "378BFE9F-25E2-4333-B947-D0FDB9F18590",
              "versionEndExcluding": "5.1.1",
              "versionStartIncluding": "5.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}