CVE-2022-0482

🗓️ 09 Mar 2022 10:20:10Reported by @huntrdevType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 2337 Views🌐 WEB

Exposure of Private Personal Information in alextselegidis/easyappointments prior to 1.4.

Reporter	Title	Published	Views	Family All 20
0day.today	Easy!Appointments < 1.4.3 - Information Disclosure Exploit	13 Apr 202200:00	–	zdt
0day.today	Easy Appointments 1.4.2 - Information Disclosure Exploit	19 Apr 202200:00	–	zdt
Huntr	in alextselegidis/easyappointments	30 Jan 202216:11	–	huntr
GithubExploit	Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Easyappointments	22 Apr 202411:10	–	githubexploit
GithubExploit	Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Easyappointments	13 Apr 202209:00	–	githubexploit
Circl	CVE-2022-0482	9 Mar 202214:11	–	circl
CNNVD	Easy!Appointments 安全漏洞	9 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-0482 Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments	9 Mar 202210:20	–	cvelist
Exploit DB	Easy Appointments 1.4.2 - Information Disclosure	19 Apr 202200:00	–	exploitdb
Github Security Blog	Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments	10 Mar 202200:00	–	github

NVD

Node

easyappointments easyappointmentsRange<1.4.3wordpress

[
  {
    "product": "alextselegidis/easyappointments",
    "vendor": "alextselegidis",
    "versions": [
      {
        "lessThan": "1.4.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
huntr	www.huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
opencirt	www.opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
github	www.github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466

Parameter	Position	Path	Description	CWE
csrfToken	request body	index.php/backend_api/ajax_get_calendar_events	Unauthenticated access to calendar events exposing PII via backend_api/ajax_get_calendar_events	CWE-863
startDate	request body	index.php/backend_api/ajax_get_calendar_events	Unauthenticated access to calendar events exposing PII via backend_api/ajax_get_calendar_events	CWE-863
endDate	request body	index.php/backend_api/ajax_get_calendar_events	Unauthenticated access to calendar events exposing PII via backend_api/ajax_get_calendar_events	CWE-863

21 Nov 2024 06:38Current

9.1High risk

Vulners AI Score9.1

CVSS 26.4

CVSS 3.19.1

CVSS 39.1

EPSS0.90789

In Wild