CVE-2023-1977: Booking Manager < 2.0.29 - Subscriber+ SSRF
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1977?
The severity of CVE-2023-1977 is considered high due to the potential for SSRF attacks.
How do I fix CVE-2023-1977?
To fix CVE-2023-1977, update the Booking Manager plugin to version 2.0.29 or later.
What is the impact of CVE-2023-1977?
CVE-2023-1977 allows an attacker with low privileges to perform SSRF attacks on the internal network.
Who is affected by CVE-2023-1977?
Users of the Booking Manager WordPress plugin versions before 2.0.29 are affected by CVE-2023-1977.
What types of attacks can be performed due to CVE-2023-1977?
Due to CVE-2023-1977, attackers can exploit the vulnerability to perform Server-Side Request Forgery (SSRF) attacks.