GitHub Advisoryadvisory · Packagist

GHSA-fc4g-f42p-7rhp alextselegidis/easyappointments Improper Access Control vulnerability

MEDIUM Published 2023-04-15 Modified 2023-04-21 Official page ↗
Aliases
CVE-2023-2104
Ecosystem
Packagist
Packages
alextselegidis/easyappointments
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2023-04-21

Affected packages

• Packagist alextselegidis/easyappointments: <= 1.4.3 (no fix yet)

Description

alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.

Related

Alias · CVE (1)

  • CVE-2023-2104 Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References