PT-2023-26186 · Cal.Com · Cal.Com

Connor Gargano · Publicado 2023-07-25 · Atualizado 2023-08-04 · CVE-2023-37919

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cal.com (affected versions not specified)

Description A vulnerability in Cal.com open-source scheduling software allows active sessions associated with an account to remain active even after enabling 2FA. When 2FA is activated on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) without having to verify the account owner's identity. No known patches or workarounds exist as of the time of publication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-37919

GHSA-CPF2-Q635-XRWX

Produtos afetados

Cal.Com

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37919.json · Exploit
• https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx · Aviso do Fabricante
• https://t.me/cibsecurity/67273 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37919 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37919 · Aviso do Fabricante