GHSA-fc4g-f42p-7rhp

alextselegidis/easyappointments Improper Access Control vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2104

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	alextselegidis/easyappointments	<= 1.4.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2104 advisory
https://github.com/alextselegidis/easyappointments/commit/75b24735767868344193fb2cc56e17ee4b9ac4be web
https://github.com/alextselegidis/easyappointments package
https://huntr.dev/bounties/3099b8d1-c49c-41b8-a929-73ccded6fc7c web