CVE-2022-0825: vulnerability in Amelia – Events & Appointments Booking Calendar
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.8%
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Affected products
Unknown · Amelia – Events & Appointments Booking CalendarRelated CVEs — Amelia – Events & Appointments Booking Calendar
In the same product, most dangerous first.
CVE-2022-0687—Amelia < 1.0.46 - Manager+ RCEEPSS 1.5%CVE-2022-0627—Amelia < 1.0.46 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-0720—Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data DisclosureEPSS 0.6%CVE-2022-0616—Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRFEPSS 0.4%