Low-Privileged User Can Create High-Privileged User, Resulting in Privilege Escalation

CVE-2023-3287

What is CVE-2023-3287?

A BOLA (Broken Object Level Authorization) vulnerability exists in the EasyAppointments application that permits a low privileged user to manipulate the system's access controls. By exploiting this flaw, the user can create higher privileged user accounts, effectively allowing unauthorized access to administrative functionalities. This vulnerability poses significant security risks as it undermines the integrity of user permissions and can lead to further malicious actions within the system.

References