CVE-2023-38055

A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*

History

26 Aug 2024, 14:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.6
v2 : unknown
v3 : 8.1
CPE cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:*
References () https://github.com/alextselegidis/easyappointments - () https://github.com/alextselegidis/easyappointments - Product
First Time Easyappointments easyappointments
Easyappointments

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad BOLA en GET, PUT, DELETE /services/{serviceId} permite a un usuario con pocos privilegios recuperar, modificar o eliminar los servicios de cualquier usuario (incluido el administrador). Esto da como resultado un acceso no autorizado y una manipulación de datos no autorizada.

09 Jul 2024, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-09 11:15

Updated : 2024-08-26 14:07


NVD link : CVE-2023-38055

Mitre link : CVE-2023-38055

CVE.ORG link : CVE-2023-38055


JSON object : View

Products Affected

easyappointments

  • easyappointments
CWE
CWE-639

Authorization Bypass Through User-Controlled Key