CVE-2022-0482
CRITICAL EXPLOITED NUCLEIGitHub alextselegidis/easyappointments <1.4.3 - Info Disclosure
Title source: llmExploitation Summary
CVE-2022-0482 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Alexandre ZANNI, Acceis, mija-pilkaite. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets an information disclosure vulnerability in Easy Appointments < 1.4.3, allowing unauthenticated access to private personal information (PII) via an API endpoint. It fetches a CSRF token and then queries the backend API to retrieve calendar events within a specified date range.
Description
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
Exploits (3)
This exploit targets an information disclosure vulnerability in Easy Appointments < 1.4.3, allowing unauthenticated access to private personal information (PII) via an API endpoint. It fetches a CSRF token and then queries the backend API to retrieve calendar events within a specified date range.
This is a functional exploit for CVE-2022-0482, an unauthenticated PII disclosure vulnerability in Easy!Appointments < 1.4.3. The script queries the API to retrieve sensitive appointment data, including customer and provider details.
This repository contains a functional Python exploit for CVE-2022-0482, an Incorrect Authorization vulnerability in Easy!Appointments versions prior to 1.4.3. The exploit leverages a missing authentication check on the `/index.php/backend_api/ajax_get_calendar_events` endpoint to retrieve sensitive appointment data.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N