CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA

Medium 6.5 Published 25 Jul 2023 Updated 16 Oct 2024

Attackers can maintain unauthorized access to Cal.com accounts after 2FA is enabled because existing sessions are not invalidated.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37919?

CVE-2023-37919 is a medium-severity vulnerability in calcom cal.com, published on 25 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.

Weakness: CWE-613

Which versions are affected by CVE-2023-37919?

It affects 1 product.

Products include Cal Cal.com.

How do I fix CVE-2023-37919?

No fix has been published for CVE-2023-37919 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-37919 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37919 exists.

Sources

Also known as GHSA-cpf2-q635-xrwx.