CVE Feed

    Dashboard / CVE / CVE-2023-32062

    CVE-2023-32062

    OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.

    Published:Nov 27, 2023
    Last Modified:Nov 21, 2024
    EPS:Nov 27, 2023
    EPSS Score:0.00195
    CVSS Score:5

    Affected Products

    Vendor
    Oroinc
    Product
    Oroplatform

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2024-50677 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web s…
    CVE-2023-48296 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite naviga…
    CVE-2023-45824 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinn…
    CVE-2022-41951 (CVSS 8.5) — OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business appli…
    CVE-2021-43852 (CVSS 8.8) — OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted reques…
    CVE-2021-41236 (CVSS 6.9) — OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnera…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High