Vulnerability-Lookup

CVE-2022-0482 (GCVE-0-2022-0482)

Vulnerability from cvelistv5 – Published: 2022-03-09 10:20 – Updated: 2024-08-02 23:32

Previdian

Title

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Summary

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Severity

9.1 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor

Assigner

@huntrdev Scorecard

References

4 references

URL	Tags
https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4…	x_refsource_CONFIRM
https://github.com/alextselegidis/easyappointment…	x_refsource_MISC
http://packetstormsecurity.com/files/166701/Easy-…	x_refsource_MISC
https://opencirt.com/hacking/securing-easy-appoin…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
alextselegidis	alextselegidis/easyappointments	Affected: unspecified , < 1.4.3 (custom)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 2bf29ba7-ac23-4413-ac4a-a5144c5fccb9

Vulnerability ID: CVE-2022-0482

Status: Confirmed

Status Updated: 2022-03-09 11:20 CET

Exploited: Yes

Timestamps

First Seen: 2022-03-09

Asserted: 2022-03-09

Scope

Notes: Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments | Affected: Alex Tselegidis / alextselegidis/easyappointments | CVSS: 9.1 (CRITICAL) | EPSS: 0.43746 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Cve Id	CVE-2022-0482
Vendor	Alex Tselegidis
Ghsa Id	GHSA-R6CM-WG48-RH2R
Product	alextselegidis/easyappointments
Added Date	2022-03-09T10:20:10.000Z
Cvss Score	9.1
Epss Score	0.43746
Previous Ids
Cvss Severity	CRITICAL
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.98704
Used In Malware	unknown
Vulnerability Id	CVE-2022-0482
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-02 09:11 CEST | Updated: 2026-10-02 09:11 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:32:45.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alextselegidis/easyappointments",
          "vendor": "alextselegidis",
          "versions": [
            {
              "lessThan": "1.4.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-14T13:49:59.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
        }
      ],
      "source": {
        "advisory": "2fe771ef-b615-45ef-9b4d-625978042e26",
        "discovery": "EXTERNAL"
      },
      "title": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0482",
          "STATE": "PUBLIC",
          "TITLE": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "alextselegidis/easyappointments",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "alextselegidis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
            },
            {
              "name": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466",
              "refsource": "MISC",
              "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
            },
            {
              "name": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
            },
            {
              "name": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/",
              "refsource": "MISC",
              "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
            }
          ]
        },
        "source": {
          "advisory": "2fe771ef-b615-45ef-9b4d-625978042e26",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0482",
    "datePublished": "2022-03-09T10:20:10.000Z",
    "dateReserved": "2022-02-03T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:32:45.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-0482",
      "date": "2026-10-02",
      "epss": "0.43746",
      "percentile": "0.98706"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "alextselegidis/easyappointments",
                "vendor": "alextselegidis",
                "versions": [
                  {
                    "lessThan": "1.4.3",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@huntr.dev"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*",
                    "matchCriteriaId": "8674457F-2360-445C-8B2B-AC5E4C32A149",
                    "versionEndExcluding": "1.4.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
          },
          {
            "lang": "es",
            "value": "Una Exposici\u00f3n de Informaci\u00f3n Personal Privada a un Actor no Autorizado en el repositorio de GitHub alextselegidis/easyappointments versiones anteriores a 1.4.3"
          }
        ],
        "id": "CVE-2022-0482",
        "lastModified": "2026-06-17T04:20:42.000",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "security@huntr.dev",
              "type": "Secondary"
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-03-09T11:15:07.857",
        "references": [
          {
            "source": "security@huntr.dev",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
          },
          {
            "source": "security@huntr.dev",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
          },
          {
            "source": "security@huntr.dev",
            "tags": [
              "Exploit",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
          },
          {
            "source": "security@huntr.dev",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
          }
        ],
        "sourceIdentifier": "security@huntr.dev",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-359"
              }
            ],
            "source": "security@huntr.dev",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

EUVD-2026-10994

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 05:57

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T05:57:22.769101+00:00",
  "id": "EUVD-2026-10994"
}

FKIE_CVE-2022-0482

Vulnerability from fkie_nvd - Published: 2022-03-09 11:15 - Updated: 2026-06-17 04:20

Previdian

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

References

URL	Tags
security@huntr.dev	http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html	Exploit, Third Party Advisory, VDB Entry
security@huntr.dev	https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466	Patch, Third Party Advisory
security@huntr.dev	https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26	Exploit, Patch, Third Party Advisory
security@huntr.dev	https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/	Third Party Advisory

Impacted products

	Vendor	Product	Version
	easyappointments	easyappointments	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "alextselegidis/easyappointments",
          "vendor": "alextselegidis",
          "versions": [
            {
              "lessThan": "1.4.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@huntr.dev"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "8674457F-2360-445C-8B2B-AC5E4C32A149",
              "versionEndExcluding": "1.4.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
    },
    {
      "lang": "es",
      "value": "Una Exposici\u00f3n de Informaci\u00f3n Personal Privada a un Actor no Autorizado en el repositorio de GitHub alextselegidis/easyappointments versiones anteriores a 1.4.3"
    }
  ],
  "id": "CVE-2022-0482",
  "lastModified": "2026-06-17T04:20:42.000",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-09T11:15:07.857",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-359"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

GHSA-R6CM-WG48-RH2R

Vulnerability from github – Published: 2022-03-10 00:00 – Updated: 2022-04-17 17:13

Summary

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Details

The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This happens on this endpoint: /index.php/backend_api/ajax_get_calendar_events Unfortunately, there is no authentication / permissions-check on that endpoint, the only required parameters in a POST request are "startDate", "endDate" and "csrfToken". Because the csrfToken can be obtained by any unauthenticated user just visiting the public form (and is valid for the backend as well), any attacker can query the backend API and obtain all sorts of private information about the appointment, in JSON format.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "alextselegidis/easyappointments"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-359",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-10T21:50:52Z",
    "nvd_published_at": "2022-03-09T11:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This happens on this endpoint: /index.php/backend_api/ajax_get_calendar_events Unfortunately, there is no authentication / permissions-check on that endpoint, the only required parameters in a POST request are \"startDate\", \"endDate\" and \"csrfToken\". Because the csrfToken can be obtained by any unauthenticated user just visiting the public form (and is valid for the backend as well), any attacker can query the backend API and obtain all sorts of private information about the appointment, in JSON format.",
  "id": "GHSA-r6cm-wg48-rh2r",
  "modified": "2022-04-17T17:13:16Z",
  "published": "2022-03-10T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alextselegidis/easyappointments"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/releases/tag/1.4.3"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
    },
    {
      "type": "WEB",
      "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments"
}

GSD-2022-0482

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Aliases

CVE-2022-0482

Aliases

CVE-2022-0482

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-0482",
    "description": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.",
    "id": "GSD-2022-0482",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2022-0482"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-0482"
      ],
      "details": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.",
      "id": "GSD-2022-0482",
      "modified": "2023-12-13T01:19:11.581099Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@huntr.dev",
        "ID": "CVE-2022-0482",
        "STATE": "PUBLIC",
        "TITLE": "Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "alextselegidis/easyappointments",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_value": "1.4.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "alextselegidis"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26",
            "refsource": "CONFIRM",
            "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
          },
          {
            "name": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466",
            "refsource": "MISC",
            "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
          },
          {
            "name": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
          },
          {
            "name": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/",
            "refsource": "MISC",
            "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
          }
        ]
      },
      "source": {
        "advisory": "2fe771ef-b615-45ef-9b4d-625978042e26",
        "discovery": "EXTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.4.3",
          "affected_versions": "All versions before 1.4.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-863",
            "CWE-937"
          ],
          "date": "2022-03-11",
          "description": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.",
          "fixed_versions": [
            "1.4.3"
          ],
          "identifier": "CVE-2022-0482",
          "identifiers": [
            "GHSA-r6cm-wg48-rh2r",
            "CVE-2022-0482"
          ],
          "not_impacted": "All versions starting from 1.4.3",
          "package_slug": "packagist/alextselegidis/easyappointments",
          "pubdate": "2022-03-10",
          "solution": "Upgrade to version 1.4.3 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-0482",
            "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466",
            "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26",
            "https://github.com/alextselegidis/easyappointments/releases/tag/1.4.3",
            "https://github.com/advisories/GHSA-r6cm-wg48-rh2r"
          ],
          "uuid": "96747728-e19c-4874-9852-d22b57dbd78a"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.4.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0482"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-359"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26"
            },
            {
              "name": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466"
            },
            {
              "name": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html"
            },
            {
              "name": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2022-06-03T17:23Z",
      "publishedDate": "2022-03-09T11:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-0482 (GCVE-0-2022-0482)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

EUVD-2026-10994

FKIE_CVE-2022-0482

GHSA-R6CM-WG48-RH2R

GSD-2022-0482

Tags

Sightings

Nomenclature

Related by attack behaviour