CVE-2023-37919 Vulnerability Details

  /     /     /  

CVE-2023-37919 Metadata Quick Info

CVE Published: 25/07/2023 | CVE Updated: 16/10/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: calcom | Product: cal.com
Status : PUBLISHED

---

CVE-2023-37919 Description

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner\'s identity. As of time of publication, no known patches or workarounds exist.

Metrics

CVSS Version: 3.1 | Base Score: 6.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* HIGH
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-613
CWE Name: CWE-613: Insufficient Session Expiration
Source: calcom

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).