Session Fixation in alextselegidis/easyappointments
CVE-2023-2105

8.8HIGH

Key Information:

Vendor: Alextselegidis
Status: Alextselegidis/easyappointments
Vendor: CVE Published:; 15 April 2023

🔔 Create Alextselegidis Vulnerability Alert

What is CVE-2023-2105?

The EasyAppointments plugin, maintained by Alex Tselegidis, contains a vulnerability that allows for session fixation prior to version 1.5.0. This flaw could potentially compromise user session security, enabling an attacker to hijack valid user sessions. Users are urged to update their installations to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

alextselegidis/easyappointments < 1.5.0

References

https://huntr.dev/bounties/de213e0b-a227-4fc3-bbe7-0b33fb...

https://github.com/alextselegidis/easyappointments/commit...

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 15, 2023
Vulnerability Reserved
Apr 15, 2023

CVE-2023-2105 Data

JSON