CVE-2022-2373

2022-08-2918:15:09

CWE-862

WPScan

web.nvd.nist.gov

cve-2022-2373

simply schedule appointments

wordpress

plugin

authorization bypass

vulnerability

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.003

Percentile

69.3%

JSON

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

Affected configurations

Nvd

Vulners

Node

nsquasimply_schedule_appointmentsRange<1.5.7.7wordpress

VendorProductVersionCPE
nsquasimply_schedule_appointments*cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
nsqua	simply_schedule_appointments	*	cpe:2.3:a:nsqua:simply_schedule_appointments::::::wordpress::*

CNA Affected

[
  {
    "product": "Simply Schedule Appointments – WordPress Booking Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.7.7",
        "status": "affected",
        "version": "1.5.7.7",
        "versionType": "custom"
      }
    ]
  }
]