Описание
Privilege escalation in easyappointments
The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user (eg. provider) can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A patch is available on the develop branch of the repository.
Пакеты
Наименование
alextselegidis/easyappointments
composer
Затронутые версииВерсия исправления
<= 1.4.3
Отсутствует
Связанные уязвимости
CVSS3: 8.8
nvd
больше 3 лет назад
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.