GitHub Advisoryadvisory · Packagist

GHSA-7f62-4887-cfv5 Privilege escalation in easyappointments

HIGH Published 2022-05-11 Modified 2022-05-25 Official page ↗
Aliases
CVE-2022-1397
Ecosystem
Packagist
Packages
alextselegidis/easyappointments
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2022-05-25

Affected packages

• Packagist alextselegidis/easyappointments: <= 1.4.3 (no fix yet)

Description

The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user (eg. provider) can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A patch is available on the `develop` branch of the repository.

Related

Alias · CVE (1)

  • CVE-2022-1397 API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References