CVE-2023-32062

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-320635.0OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from anCVE-2023-320644.3OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information aboutCVE-2023-320655.8OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information maCVE-2023-320665.4Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping tCVE-2023-320677.5c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forgCVE-2023-320686.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's pCVE-2023-320698.8XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible foCVE-2023-320706.1XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute valuesCVE-2023-320719.0XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's pCVE-2023-320724.8Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version CVE-2023-320738.8WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/clonCVE-2023-320749.8user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended tha