CVE-2022-0709CWE-200

Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

published April 4, 2022

CVSS
—
EPSS
2%
Percentile
75.9
In the wild
Unconfirmed
What it is

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01619 · 75.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-04-04T15:35Z
EPSS history
Timeline
  • 04 APR 15:35Z
    Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
    cvelistv5