VulnerabilityModified

CVE-2023-37919

A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA.

MEDIUM 5.4EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-613
Affected: cal/cal.com
Source: security-advisories@github.com

References

https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwxVendor Advisory
https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwxVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.