Lucene search
HistoryJul 09, 2024 - 11:15 a.m.
CVE-2023-3289
bola vulnerability
low privileged user
unauthorized service
admin
unauthorized data manipulation
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
16.8%
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
Affected configurations
Node
easyappointmentseasyappointmentsRange<1.5.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| easyappointments | easyappointments | * | cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:* |
Related
veracode
veracode
Authorization Bypass
2024-07-12 04:22:57
cvelist
cvelist
vulnrichment
vulnrichment
osv
osv
CVE-2023-3289
2024-07-09 11:15:12
cve
cve
CVE-2023-3289
2024-07-09 11:15:12
paloalto
paloalto
PAN-OS: OS Command Injection Vulnerability in the Web Interface
2023-12-13 17:00:00
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
16.8%
Related for NVD:CVE-2023-3289