Lucene search

GitHub Advisory DatabaseGHSA-J6QQ-9939-9JV8

HistoryApr 15, 2023 - 3:30 p.m.

alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

2023-04-1515:30:15

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

easyappointments

software vulnerability

version 1.4.3

patch

commit bddc5cbeb7ff237a72943b304dcb01c653781767

version 1.5.0

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.5%

JSON

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0.

Affected configurations

Vulners

Node

alextselegidiseasyappointmentsRange≤1.4.3

VendorProductVersionCPE
alextselegidiseasyappointments*cpe:2.3:a:alextselegidis:easyappointments:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
alextselegidis	easyappointments	*	cpe:2.3:a:alextselegidis:easyappointments::::::::

References

github.com/advisories/GHSA-j6qq-9939-9jv8

github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767

huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44

nvd.nist.gov/vuln/detail/CVE-2023-2102