Skip to content
OpenAdvisories
Medium · 5.0 CVE-2023-3290 EUVD-2023-43965GHSA-h38r-5m65-j9vp

A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0

Published Jul 9, 2024 · Updated Aug 2, 2024 · Assigned by palo_alto

Description

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.

Affected products

VendorProductAffectedFixed
— easyappointments — —

References