Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-38055: A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

CVE-2023-38055 · published 2 years ago

Summary

A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation.

What to do

Update easyappointments easyappointments to version 1.5.0 or later.

Affected software

Vendor	Product	Affected versions
easyappointments	easyappointments	< 1.5.0 `cpe:2.3:a:easyappointments:easyappointments::::::::`

Original advisory text

A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38055... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-38055 Vendor Advisory
https://github.com/alextselegidis/easyappointments Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published9 Jul 2024

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-38055 · NVD

CVE-2023-38055 · OSV

Track software like this

Free during beta