Issue 180: API vulnerability in Easy!Appointments platform, new APIs compromising security
Brief
This week, we have news of an API vulnerability in the scheduling platform Easy! Appointments allowing unauthorized access. We also have articles on whether the growth in APIs compromises security, how API traffic visibility is a key for API security, and some basic tips on locking down APIs to improve security.
Vulnerability: API access control vulnerability in scheduling platform Easy!Appointments
This week, we have an API vulnerability in the open-source scheduling platform Easy! Appointments , courtesy of The Daily Swig. The vulnerability was discovered by security researcher Francesco Carlucci, and it is tracked as CVE-2022-048 , with a CVSS score of 9.
- Carlucci discovered that the method ajax_get_calendar_events() passed three parameters – startDate , endDate , csrfToken – and no authentication tokens or headers.