CVE-2022-0720CWE-863

CVE-2022-0720: fallo en Amelia – Events & Appointments Booking Calendar

Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Amelia – Events & Appointments Booking Calendar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 0.6%
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Productos afectados
Unknown · Amelia – Events & Appointments Booking Calendar
CVEs relacionadas — Amelia – Events & Appointments Booking Calendar

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-0687—Amelia < 1.0.46 - Manager+ RCEEPSS 1.5%CVE-2022-0825—Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status UpdateEPSS 0.8%CVE-2022-0627—Amelia < 1.0.46 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-0616—Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRFEPSS 0.4%