PT-2023-3709 · Unknown · Easyappointments

Published 2023-07-17 · Updated 2023-08-02 · CVE-2023-3700

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions easyappointments versions prior to 1.5.0

Description The issue is related to improper access control in the easyappointments application, which can allow a remote attacker to gain unauthorized access to restricted functions. This is due to a lack of control over user access.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions until the update is applied.

Exploit

Fix

IDOR

Improper Access Control

Weakness Enumeration

CWE-639

CWE-284

Related Identifiers

BDU:2023-03997

CVE-2023-3700

GHSA-8C6Q-26W6-QWHG

Affected Products

Easyappointments

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3700.json · Exploit
• 🔥 https://huntr.dev/bounties/e8d530db-a6a7-4f79-a95d-b77654cc04f8 · Exploit
• https://github.com/alextselegidis/easyappointments/commit/b37b46019553089db4f22eb2fe998bca84b2cb64 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-3700 · Security Note
• https://bdu.fstec.ru/vul/2023-03997 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3700 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c6q-26w6-qwhg · Vendor Advisory
• https://github.com/alextselegidis/easyappointments · Note
• https://vuldb.com/ru/?id.234261 · Note
• https://security.snyk.io/vuln/SNYK-PHP-ALEXTSELEGIDISEASYAPPOINTMENTS-5777727 · Note
• https://t.me/cvenotify/54472 · Telegram Post
• https://t.me/cibsecurity/66802 · Telegram Post