critical9.8
CVE-2021-45914
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request.
Impact
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Luxsoft | Luxcal | before 5.2.0 |
References
- NVD record
- CVE.org record
- https://github.com/h1pmnh
- https://h1pmnh.github.io/post/cve-luxcal-2021/
- https://twitter.com/h1pmnh
- https://www.luxsoft.eu/index.php?pge=dload
- https://github.com/h1pmnh
- https://h1pmnh.github.io/post/cve-luxcal-2021/
- https://twitter.com/h1pmnh
- https://www.luxsoft.eu/index.php?pge=dload