PT-2023-30969 · Unknown · Availability Booking Calendar

Published 2023-12-06 · Updated 2023-12-09 · CVE-2023-48825

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Availability Booking Calendar version 5.0

Description The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or the Default Country Code.

Recommendations For Availability Booking Calendar version 5.0, update to a version that fixes the Multiple HTML Injection issues, specifically addressing the vulnerabilities related to the SMS API Key and the Default Country Code. As a temporary workaround, consider restricting access to the SMS API Key and reviewing the Default Country Code settings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48825

Affected Products

Availability Booking Calendar

References · 5

• 🔥 http://packetstormsecurity.com/files/176033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48825 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48825 · Vendor Advisory
• https://twitter.com/CVEnew/status/1732651029110374543 · Twitter Post
• https://t.me/cvenotify/62678 · Telegram Post