Unscored CVE-2021-45914 EUVD-2021-32629GHSA-g365-5x48-7j84

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session …

Published May 24, 2022 · Updated Aug 4, 2024 · Assigned by mitre

Description

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.

References

https://github.com/h1pmnh
https://twitter.com/h1pmnh
https://www.luxsoft.eu/index.php?pge=dload
https://h1pmnh.github.io/post/cve-luxcal-2021/