CVE-2024-6552 - Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure

Back Back to CVE browser

MEDIUM

Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure

Published Aug 8, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.

Affected products

Vendor Ameliabooking Product Booking for Appointments and Events Calendar – Amelia Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ameliabooking

Booking for Appointments and Events Calendar – Amelia

unaffected

Version	Status	Constraints
-	affected	<=1.2

Vendor Tms-Outsource Product Amelia Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tms-Outsource

Amelia

n/a

Version	Status	Constraints
0	affected	<=1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47625		Advisory
https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/vendor/symfony/http-foundation/Tests/Fixtures/response-functional/cookie_max_age.php
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3130903%40ameliabooking&new=3130903%40ameliabooking&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/c9aa2a44-5a71-4a10-9876-3d54b8d268c5?source=cve