alextselegidis/easyappointments · Security
alextselegidis/easyappointments Improper Access Control vulnerability
- GHSA ID
- GHSA-fc4g-f42p-7rhp
- CVE ID
- CVE-2023-2104
- Severity
- medium
- Published
- Updated
- CVSS
- 5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.
CWEs
- CWE-284 · Improper Access Control