PT-2023-26186 · Cal.Com · Cal.Com

Connor Gargano · Published 2023-07-25 · Updated 2023-08-04 · CVE-2023-37919

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cal.com (affected versions not specified)

Description A vulnerability in Cal.com open-source scheduling software allows active sessions associated with an account to remain active even after enabling 2FA. When 2FA is activated on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) without having to verify the account owner's identity. No known patches or workarounds exist as of the time of publication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-37919

GHSA-CPF2-Q635-XRWX

Affected Products

Cal.Com

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37919.json · Exploit
• https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37919 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37919 · Vendor Advisory
• https://t.me/cibsecurity/67273 · Telegram Post