CVE-2022-1397 - API Privilege Escalation in alextselegidis/easyappointments

HIGH

API Privilege Escalation in alextselegidis/easyappointments

Published May 10, 2022

8.8

HIGH

CVSS 3.1

EPSS 1.17%

API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<1.5.0

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2979		Advisory
https://github.com/advisories/GHSA-7f62-4887-cfv5		Advisory
https://github.com/alextselegidis/easyappointments/commit/63dbb51decfcc1631c398ecd6d30e3a337845526		x_refsource_MISCPatchTechnical Description
https://huntr.dev/bounties/5f69e094-ab8c-47a3-b01d-8c12a3b14c61		x_refsource_CONFIRMExploitIssue TrackingPatchTechnical Description
https://nvd.nist.gov/vuln/detail/CVE-2022-1397