Lucene search

MitreCVE-2023-33562

HistoryAug 01, 2023 - 11:15 p.m.

CVE-2023-33562

2023-08-0123:15:29

mitre

web.nvd.nist.gov

cve-2023-33562

php jabbers

time slots booking calendar

user enumeration

password recovery

brute force attack

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

Affected configurations

Nvd

Node

phpjabberstime_slots_booking_calendarMatch3.3

VendorProductVersionCPE
phpjabberstime_slots_booking_calendar3.3cpe:2.3:a:phpjabbers:time_slots_booking_calendar:3.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpjabbers	time_slots_booking_calendar	3.3	cpe:2.3:a:phpjabbers:time_slots_booking_calendar:3.3:::::::*

References

medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4

www.phpjabbers.com/time-slots-booking-calendar/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

Related for CVE-2023-33562