CVE-2023-33409
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Minical version 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.
Risk Assessment
A CSRF attack could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to data loss or system integrity breaches.
Recommendation
It is recommended to implement CSRF tokens in forms and validate the source of requests to minimize the risk of attacks.
Other vulnerabilities in Minical 1.0.0
See all- CVE-2023-3307Medium
A critical vulnerability was found in miniCal 1.0.0, affecting unknown processing of the file /booking/show_bookings/. Manipulation of the argument search_query leads to SQL injection.
- CVE-2023-33408Medium
Minical version 1.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input validation in the application's user input handling in the security_helper.php file.
Original NVD description (English source)
Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS