CVE-2023-38047CWE-639

A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.

High · published July 9, 2024

CVSS v3.1
8.5
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-07-09T10:25Z
EPSS history
Timeline
  • 09 JUL 10:25Z
    A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.
    cvelistv5