CVE-2022-0482

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Affected

alextselegidis · alextselegidis/easyappointments

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v3.0 HUNTR

9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 NVD

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

43.75% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical

Published

2022-03-09

Updated

2024-08-02

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
• https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
• Acceis/exploit-CVE-2022-04823★ · 2022-05-27
• mija-pilkaite/CVE-2022-0482_exploit1★ · 2024-04-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0482.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50871

Security advisories

• alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
• https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482
• advisories/GHSA-r6cm-wg48-rh2r

References

• CVE Record
• NVD entry

Related

• CVE-2022-24780
• CVE-2023-23752
• CVE-2023-38490