ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Easy!Appointments

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments

Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.

Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).

Palo Alto Unit 42 · 29d agoVulnerabilityCVE-2023-3285CVE-2023-3286CVE-2023-3287+13 CVEs

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42 · 29d agoResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

Related CVEs

  • CVE-2023-32888.8<1%
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system.
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-32878.8<1%
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system.
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-380518.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary).
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380548.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer).
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380508.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin).
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380478.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including ad
    A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-32857.7<1%
    A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin).
    A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.
    —
  • CVE-2023-32896.5<1%
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin).
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2024-13136.5<1%
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and…
    —
  • CVE-2023-32905.0<1%
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system.
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
    · easyappointments easyappointments—

Appears with

vendor Palo Alto Networks 2organization Unit 42 2product Grafana 2threat actor Unit 42 2organization Palo Alto Networks 2ai model BOLABuster 1vendor Easy!Appointments 1product Harbor 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.