GHSA-fc4g-f42p-7rhp

ghsaUSosv

alextselegidis/easyappointments Improper Access Control vulnerability

view advisory published 2023-04-15Licence: CC-BY-4.0

alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-2104US	medium5.4	0.45% (39th)	—	2023-04-15
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

references

External citations — patches, advisories, analysis.

https://github.com/alextselegidis/easyappointmentsPACKAGE
https://github.com/alextselegidis/easyappointments/commit/75b24735767868344193fb2cc56e17ee4b9ac4beWEB
https://huntr.dev/bounties/3099b8d1-c49c-41b8-a929-73ccded6fc7cWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-2104ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan