PT-2024-12030 · Wpdevart · Wpdevart Booking Calendar

Yuyudhn · Published 2024-06-03 · Updated 2024-06-04 · CVE-2023-24373

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WpDevArt Booking calendar, Appointment Booking System versions 3.2.3 and earlier

Description The issue affects the WpDevArt Booking calendar, Appointment Booking System, allowing manipulation of hidden fields due to an External Control of Assumed-Immutable Web Parameter vulnerability. This enables an attacker to modify assumed-immutable web parameters, potentially leading to unauthorized access or data manipulation.

Recommendations For versions 3.2.3 and earlier, update to a version later than 3.2.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2023-24373

Affected Products

Wpdevart Booking Calendar

References · 7

• https://osv.dev/vulnerability/CVE-2023-24373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24373 · Security Note
• https://t.me/cvenotify/81959 · Telegram Post
• https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-bypass-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/81811 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1797788759154417868 · Twitter Post
• https://twitter.com/CVEnew/status/1797747867735732290 · Twitter Post