PT-2023-30732 · Unknown · Availability Booking Calendar

Published 2023-12-06 · Updated 2023-12-11 · CVE-2023-48207

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Availability Booking Calendar version 5.0

Description The issue allows CSV injection via the unique ID field in the Reservations list component.

Recommendations For Availability Booking Calendar version 5.0, consider restricting access to the Reservations list component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the unique ID field in the Reservations list component.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-48207

Affected Products

Availability Booking Calendar

References · 6

• 🔥 http://packetstormsecurity.com/files/175804 · Exploit
• https://osv.dev/vulnerability/CVE-2023-48207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48207 · Security Note
• https://t.me/cvenotify/62674 · Telegram Post
• https://twitter.com/CVEnew/status/1732646257796305172 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1732728460236263560 · Twitter Post