CVE-2022-2373 Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure

What is CVE-2022-2373?

CVE-2022-2373 is a medium-severity missing authorization vulnerability in Unknown Simply Schedule Appointments – WordPress Booking Plugin, published on 29 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

Weakness: CWE-862

Which versions are affected by CVE-2022-2373?

It affects 1 product.

Products include Nsqua Simply Schedule Appointments.

How do I fix CVE-2022-2373?

No fix has been published for CVE-2022-2373 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-2373 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2373 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Unknown Simply Schedule Appointments – WordPress Booking Plugin

• CVE-2023-50851 WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection High 7.6
• CVE-2024-7129 Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE High 7.2
• CVE-2024-7876 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS Medium 4.8
• CVE-2024-7877 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS Medium 4.8
• CVE-2022-2374 Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v22h-7mrq-rcj9.