CVE-2022-0720 Vulnerability Details

  /     /     /  

CVE-2022-0720 Metadata Quick Info

CVE Published: 28/03/2022 | CVE Updated: 02/08/2024 | CVE Year: 2022
Source: WPScan | Vendor: Unknown | Product: Amelia – Events & Appointments Booking Calendar
Status : PUBLISHED

---

CVE-2022-0720 Description

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\'s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-863
CWE Name: CWE-863 Incorrect Authorization
Source: Unknown

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).