CVE-2022-0482 Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

What is CVE-2022-0482?

CVE-2022-0482 is a critical vulnerability in alextselegidis/easyappointments, published on 9 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Weakness: CWE-863, CWE-359

Which versions are affected by CVE-2022-0482?

2 open source packages ship an affected version, including alextselegidis/easyappointments. It affects 1 product.

Products include Easyappointments Easyappointments.

How do I fix CVE-2022-0482?

Upgrade alextselegidis/easyappointments to 1.4.3 or later.

Is CVE-2022-0482 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0482 exists.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in alextselegidis/easyappointments

• CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 Critical 9.9
• CVE-2023-38048 A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0 Critical 9.9
• CVE-2023-38049 A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 Critical 9.9
• CVE-2023-38051 A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0 Critical 9.9
• CVE-2023-38052 A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0 Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6cm-wg48-rh2r.