What’s Vulnerable › Vulnerabilities

CVE-2023-32062: OroCalendarBundle has incorrect system calendar events visibility

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-27 · updated 2026-06-17
• Weakness: CWE-284

Description

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.

Affected products

• oroinc platform: from 4.2.0 through 4.2.6; from 5.0.0 before 5.0.7; from 5.1.0 before 5.1.1 — fixed in 5.0.7, 5.1.1

How to fix

Upgrade to a fixed version: oroinc platform 5.0.7, 5.1.1. Check the vendor advisory for mitigations.

References

• https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b
• https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531
• https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g
• https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b
• https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531
• https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g

Get alerted when CVE-2023-32062 or the next vulnerability affects your stack