Описание
OroCRMCallBundle has incorrect call view page visibility
Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks.
Ссылки
Пакеты
Наименование
oro/crm-call-bundle
composer
Затронутые версииВерсия исправления
>= 4.2.0, <= 4.2.5
Отсутствует
Наименование
oro/crm-call-bundle
composer
Затронутые версииВерсия исправления
>= 5.0.0, < 5.0.4
5.0.4
Наименование
oro/crm-call-bundle
composer
Затронутые версииВерсия исправления
>= 5.1.0, < 5.1.1
5.1.1
Связанные уязвимости
CVSS3: 5
nvd
около 2 лет назад
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.