CVE-2023-38052

CVE-2023-38052 describes a BOLA vulnerability in the EasyAppointments API where GET, PUT, DELETE /admins/{adminId} endpoints permit a low-privileged user to fetch, modify, or delete a high-privileged admin, leading to unauthorized access and data manipulation. Multiple sources associate this with...

CVE-2023-38052 A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /admins/adminId allows a low privileged user to fetch, modify or delete a high privileged user admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051 A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38050 A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38050 A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38049

CVE-2023-38049 (Easy!Appointments) : The connected sources confirm a BOLA vulnerability in GET, PUT, and DELETE /appointments/{appointmentId} affecting Easy!Appointments versions

CVE-2023-38049 A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /appointments/appointmentId allows a low privileged user to fetch, modify or delete an appointment of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38048 A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38048 A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38047

CVE-2023-38047 affects Easy!Appointments prior to 1.5.0. The issue is an authorization flaw in GET, PUT, and DELETE on /categories/{categoryId} that lets a low-privileged user fetch, modify, or delete category data for any user (including admins), causing unauthorized access and data manipulation...

CVE-2023-38047 A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3290

Consolidated from connected records, CVE-2023-3290 applies to EasyAppointments, specifically the vulnerability in POST /customers. The root cause is an insecure authorization check that lets a low-privileged user create another low-privileged customer, enabling unauthorized data manipulation. Rel...

CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12688 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /customers/customerId" endpoint allows a low-privileged user to fetch, modify, or delete a customer,...

PT-2024-12687 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in GET, PUT, DELETE "/settings/settingName" allows a low privileged user to fetch, modify or delete the settings of any user,...

PT-2024-12370 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "POST /customers" endpoint allows a low-privileged user to create a new low-privileged user customer in the system, resultin...