Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mYzRnLWY0MnAtN3JocM4AAyzH
alextselegidis/easyappointments Improper Access Control vulnerability
alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.
Permalink: https://github.com/advisories/GHSA-fc4g-f42p-7rhpJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mYzRnLWY0MnAtN3JocM4AAyzH
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago
CVSS Score: 5.4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Identifiers: GHSA-fc4g-f42p-7rhp, CVE-2023-2104
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-2104
- https://github.com/alextselegidis/easyappointments/commit/75b24735767868344193fb2cc56e17ee4b9ac4be
- https://huntr.dev/bounties/3099b8d1-c49c-41b8-a929-73ccded6fc7c
- https://github.com/advisories/GHSA-fc4g-f42p-7rhp
Blast Radius: 1.0
Affected Packages
packagist:alextselegidis/easyappointments
Dependent packages: 0Dependent repositories: 0
Downloads: 228 total
Affected Version Ranges: <= 1.4.3
No known fixed version
All affected versions: 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.1, 1.4.2, 1.4.3