PT-2019-12331 · Simplybook.Me · Simplybook.Me Enterprise

Published 2019-04-25 · Updated 2020-08-24 · CVE-2019-11489

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SimplyBook.me Enterprise versions prior to 2019-04-23

Description The issue allows authenticated low-privilege users to elevate their privileges to full admin rights. This can be achieved via a crafted HTTP PUT request, as demonstrated by modified JSON data to a "/v2/rest/" API endpoint. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For SimplyBook.me Enterprise versions prior to 2019-04-23, update to a version released after 2019-04-23 to resolve the issue. As a temporary workaround, consider restricting access to the "/v2/rest/" API endpoint to minimize the risk of exploitation. Avoid using modified JSON data in this endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2019-11489

Affected Products

Simplybook.Me Enterprise

References · 4

• 🔥 https://cybrgrade.com/files/Report_SimplyBookIt_Privesc_by_CybrGradeUKLtd.pdf · Exploit
• 🔥 https://blog.cybrgrade.com/CVE-2019-11489-SimplyBook.me-privesc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11489 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11489 · Vendor Advisory