CVE-2023-38052

A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*

History

26 Aug 2024, 13:42

Type Values Removed Values Added
CPE cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 9.9
v2 : unknown
v3 : 8.1
References () https://github.com/alextselegidis/easyappointments - () https://github.com/alextselegidis/easyappointments - Product
First Time Easyappointments easyappointments
Easyappointments

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad BOLA en GET, PUT, DELETE /admins/{adminId} permite a un usuario con pocos privilegios buscar, modificar o eliminar a un usuario con muchos privilegios (admin). Esto da como resultado un acceso no autorizado y una manipulación de datos no autorizada.

09 Jul 2024, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-09 11:15

Updated : 2024-08-26 13:42


NVD link : CVE-2023-38052

Mitre link : CVE-2023-38052

CVE.ORG link : CVE-2023-38052


JSON object : View

Products Affected

easyappointments

  • easyappointments
CWE
CWE-639

Authorization Bypass Through User-Controlled Key