Client Relationship Management CVEs and Security Vulnerabilities

CVE-2023-32063

OroCRMCallBundle has incorrect call view page visibility

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Oroinc

Products

Client Relationship Management

CVE-2021-39198

The disqualify lead action may be executed without CSRF token check

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed