PT-2023-30733 · Unknown · Availability Booking Calendar

Published 2023-12-06 · Updated 2023-12-09 · CVE-2023-48208

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Availability Booking Calendar version 5.0

Description A Cross Site Scripting issue allows an attacker to inject JavaScript via the name, plugin sms api key, plugin sms country code, uuid, title, or country name parameter to "index.php".

Recommendations For Availability Booking Calendar version 5.0, consider disabling the parameters name, plugin sms api key, plugin sms country code, uuid, title, and country name in the "index.php" file until a patch is available. Restrict access to the "index.php" file to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48208

Affected Products

Availability Booking Calendar

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-48208 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48208 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1732726688860016740 · Twitter Post
• https://twitter.com/CVEnew/status/1732651026023415890 · Twitter Post
• http://packetstormsecurity.com/files/175805 · Note
• https://t.me/cvenotify/62675 · Telegram Post