CVE-2022-2373

2022-08-2918:15:09

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-2373

simply schedule appointments

wordpress

plugin

authorization bypass

vulnerability

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.003 Low

EPSS

Percentile

69.3%

JSON

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

Affected configurations

Vulners

NVD

Node

wordpressplugin_newsletter_pluginRange<1.5.7.7

VendorProductVersionCPE
wordpressplugin_newsletter_plugin*cpe:2.3:a:wordpress:plugin_newsletter_plugin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wordpress	plugin_newsletter_plugin	*	cpe:2.3:a:wordpress:plugin_newsletter_plugin::::::::

CNA Affected

[
  {
    "product": "Simply Schedule Appointments – WordPress Booking Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.7.7",
        "status": "affected",
        "version": "1.5.7.7",
        "versionType": "custom"
      }
    ]
  }
]