CVE-2023-1977
Booking Manager < 2.0.29 - Subscriber+ SSRF
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
16 Aug 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Affected products
Unknown · Booking ManagerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →