CVE-2023-3290

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*

History

26 Aug 2024, 14:08

Type Values Removed Values Added
References () https://github.com/alextselegidis/easyappointments - () https://github.com/alextselegidis/easyappointments - Product
CPE cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*
First Time Easyappointments easyappointments
Easyappointments

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad BOLA en POST /customers permite a un usuario con pocos privilegios crear un usuario con pocos privilegios (cliente) en el sistema. Esto da como resultado una manipulación de datos no autorizada.

09 Jul 2024, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-09 11:15

Updated : 2024-08-26 14:08


NVD link : CVE-2023-3290

Mitre link : CVE-2023-3290

CVE.ORG link : CVE-2023-3290


JSON object : View

Products Affected

easyappointments

  • easyappointments
CWE
CWE-639

Authorization Bypass Through User-Controlled Key