CVE-2023-32295 - OpenCVE

Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-04-11T11:54:45.773Z

Updated: 2024-08-02T15:10:24.414Z

Reserved: 2023-05-08T07:25:57.957Z

Link: CVE-2023-32295

Vulnrichment

Updated: 2024-08-02T15:10:24.414Z

NVD

Status : Awaiting Analysis

Published: 2024-04-11T12:15:07.707

Modified: 2024-07-11T15:15:10.923

Link: CVE-2023-32295

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32295", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2023-05-08T07:25:57.957Z", "datePublished": "2024-04-11T11:54:45.773Z", "dateUpdated": "2024-08-02T15:10:24.414Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "easyappointments", "product": "Easy!Appointments", "vendor": "Alex Tselegidis", "versions": [{"changes": [{"at": "1.4.0", "status": "unaffected"}], "lessThanOrEqual": "1.3.3", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jonas H\u00f6benreich (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.<p>This issue affects Easy!Appointments: from n/a through 1.3.3.</p>"}], "value": "Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-11T14:28:59.468Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 1.4.0 or a higher version."}], "value": "Update to\u00a01.4.0 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2023-05-08T08:40:00.000Z", "value": "Vendor notified about the vulnerability."}, {"lang": "en", "time": "2024-08-10T11:51:00.000Z", "value": "Vendor notified about disclosure."}, {"lang": "en", "time": "2024-04-11T11:53:00.000Z", "value": "WordPress plugins review team notified."}], "title": "WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-17T14:00:44.440145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:26:14.374Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.414Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.414Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-17T14:00:44.440145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.831Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jonas H\u00f6benreich (Patchstack Alliance)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Alex Tselegidis", "product": "Easy!Appointments", "versions": [{"status": "affected", "changes": [{"at": "1.4.0", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3.3"}], "packageName": "easyappointments", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2023-05-08T08:40:00.000Z", "value": "Vendor notified about the vulnerability."}, {"lang": "en", "time": "2024-08-10T11:51:00.000Z", "value": "Vendor notified about disclosure."}, {"lang": "en", "time": "2024-04-11T11:53:00.000Z", "value": "WordPress plugins review team notified."}], "solutions": [{"lang": "en", "value": "Update to\u00a01.4.0 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 1.4.0 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.<p>This issue affects Easy!Appointments: from n/a through 1.3.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-11T14:28:59.468Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32295", "state": "PUBLISHED", "dateUpdated": "2024-08-02T15:10:24.414Z", "dateReserved": "2023-05-08T07:25:57.957Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-04-11T11:54:45.773Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}