We have identified an issue with the Calendar application present in IP.Board 2.3.6 and 3.0.5. This issue can allow a visitor to delete events in the Calendar even if the user does not have the proper permissions to do so. Other than the ability to delete events without permission there are no other security risks with this issue.
Please apply this patch if you are using IP.Board version 2.3.6 or 3.0.5 and you are using the Calendar application. If you do not use the Calendar application then there is no need to be concerned with this update.
Patch files are attached to this topic. The main downloads for IP.Board 2.3.6 and 3.0.5 have been updated.
Kanał Rss
Kanał Atom