PT-2023-30733 · Unknown · Availability Booking Calendar

Publicado 2023-12-06 · Atualizado 2023-12-09 · CVE-2023-48208

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Availability Booking Calendar version 5.0

Description A Cross Site Scripting issue allows an attacker to inject JavaScript via the name, plugin sms api key, plugin sms country code, uuid, title, or country name parameter to "index.php".

Recommendations For Availability Booking Calendar version 5.0, consider disabling the parameters name, plugin sms api key, plugin sms country code, uuid, title, and country name in the "index.php" file until a patch is available. Restrict access to the "index.php" file to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-48208

Produtos afetados

Availability Booking Calendar

Referências · 6

• https://twitter.com/VulmonFeeds/status/1732726688860016740 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1732651026023415890 · Publicação no Twitter
• http://packetstormsecurity.com/files/175805 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-48208 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48208 · Aviso do Fabricante
• https://t.me/cvenotify/62675 · Publicação no Telegram