CVE-2021-45914

Description

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.

Affected Platforms

Weakness Type

NVD-CWE-noinfo

References

• https://github.com/h1pmnh
• https://h1pmnh.github.io/post/cve-luxcal-2021/
• https://twitter.com/h1pmnh
• https://www.luxsoft.eu/index.php?pge=dload
• https://github.com/h1pmnh
• https://h1pmnh.github.io/post/cve-luxcal-2021/