CVE-2023-38047

CVE-2023-38047 affects Easy!Appointments prior to 1.5.0. The issue is an authorization flaw in GET, PUT, and DELETE on /categories/{categoryId} that lets a low-privileged user fetch, modify, or delete category data for any user (including admins), causing unauthorized access and data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3290

Consolidated from connected records, CVE-2023-3290 applies to EasyAppointments, specifically the vulnerability in POST /customers. The root cause is an insecure authorization check that lets a low-privileged user create another low-privileged customer, enabling unauthorized data manipulation. Rel...

CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12687 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in GET, PUT, DELETE "/settings/settingName" allows a low privileged user to fetch, modify or delete the settings of any user,...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

PT-2024-12688 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /customers/customerId" endpoint allows a low-privileged user to fetch, modify, or delete a customer,...

CVE-2023-38055: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

PT-2024-12345

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "POST /secretaries" endpoint allows a low-privileged user to create a low-privileged user secretary in the system, resulting i...

CVE-2023-38047: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38049: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /appointments/appointmentId allows a low privileged user to fetch, modify or delete an appointment of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3289: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3285: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-38051: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

PT-2024-12367

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description A BOLA vulnerability in the "POST /services" endpoint allows a low-privileged user to create a service for any user in the system, including admin, resulting in unauthorized data manipulatio...

PT-2024-12370 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "POST /customers" endpoint allows a low-privileged user to create a new low-privileged user customer in the system, resultin...

PT-2024-12685

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "GET, PUT, DELETE /secretaries/secretaryId" endpoint allows a low-privileged user to fetch, modify, or delete a low-privileged...