Vulnerability Description
Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable 'tn' parameter to read files outside the intended directory by manipulating directory path traversal techniques.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://web.archive.org/web/20190612055926/https://sourceforge.net/projects/phps
- https://www.bookedscheduler.com
- https://www.exploit-db.com/exploits/48428
- https://www.vulncheck.com/advisories/booked-scheduler-authenticated-directory-tr
FAQ
What is CVE-2020-37077?
CVE-2020-37077 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploi...
How severe is CVE-2020-37077?
CVE-2020-37077 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-37077?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.