CVE-2022-0482 - OpenCVE

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Easyappointments	Easyappointments

Configuration 1 [-]

cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-03-09T10:20:10

Updated: 2024-08-02T23:32:45.468Z

Reserved: 2022-02-03T00:00:00

Link: CVE-2022-0482

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-03-09T11:15:07.857

Modified: 2022-06-03T17:23:10.567

Link: CVE-2022-0482

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "alextselegidis/easyappointments", "vendor": "alextselegidis", "versions": [{"lessThan": "1.4.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-359", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-14T13:49:59", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC"], "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"}], "source": {"advisory": "2fe771ef-b615-45ef-9b4d-625978042e26", "discovery": "EXTERNAL"}, "title": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-0482", "STATE": "PUBLIC", "TITLE": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "alextselegidis/easyappointments", "version": {"version_data": [{"version_affected": "<", "version_value": "1.4.3"}]}}]}, "vendor_name": "alextselegidis"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}]}, "references": {"reference_data": [{"name": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"}, {"name": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466", "refsource": "MISC", "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"}, {"name": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"}, {"name": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/", "refsource": "MISC", "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"}]}, "source": {"advisory": "2fe771ef-b615-45ef-9b4d-625978042e26", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:32:45.468Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-0482", "datePublished": "2022-03-09T10:20:10", "dateReserved": "2022-02-03T00:00:00", "dateUpdated": "2024-08-02T23:32:45.468Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "8674457F-2360-445C-8B2B-AC5E4C32A149", "versionEndExcluding": "1.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."}, {"lang": "es", "value": "Una Exposici\u00f3n de Informaci\u00f3n Personal Privada a un Actor no Autorizado en el repositorio de GitHub alextselegidis/easyappointments versiones anteriores a 1.4.3"}], "id": "CVE-2022-0482", "lastModified": "2022-06-03T17:23:10.567", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-09T11:15:07.857", "references": [{"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"}, {"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"}, {"source": "security@huntr.dev", "tags": ["Third Party Advisory"], "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}], "source": "security@huntr.dev", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Secondary"}]}