CVE-2022-0482: alextselegidis alextselegidis/easyappointments
CVSS: 9.1v3.0CriticalModified
Published 09-03-2022Last modified 02-08-2024
Vulnerability summary
CVE-2022-0482 is a critical (CVSS 9.1) vulnerability in alextselegidis alextselegidis/easyappointments. EPSS estimates a 43.75% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 3 public exploits are recorded.
CVSS score
9.1/10
010
Critical · v3.0 (CVE.org)EPSS score
43.75%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database
Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
CVSS metrics
4 scores · 2 sources · 3 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesSingle source
Critical 9.1Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
43.75%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 43.75% on 19-09-2026
19-09-202619-10-2026
EPSS score43.75%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (huntr.dev)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Easy Appointments 1.4.2 - Information Disclosure
Maturity: poc
Weaknesses
CWE · root cause- CWE-359Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Alextselegidis1 product
- alextselegidis/easyappointments≥ unspecified, < 1.4.3
Easyappointments1 product
- easy\!appointments< 1.4.3
2 vendors · 2 products
References
4 links- huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26X Refsource CONFIRMExploitPatchThird Party Advisory
- github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466X Refsource MISCPatchThird Party Advisory
- packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry