Skip to main content

Amelia CVE-2024-22298

CRITICAL
Missing Authorization (CWE-862)
2024-06-10 audit@patchstack.com
Authentication Bypass Amelia
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 10, 2024 - 08:15 nvd
CRITICAL 9.8

DescriptionNVD

Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98.

AnalysisAI

Missing Authorization vulnerability in TMS Amelia ameliabooking.0.98. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. Missing Authorization vulnerability in TMS Amelia ameliabooking.0.98. Affected products include: Tms-Outsource Amelia. Version information: through 1.0.98..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

More in Amelia

View all
CVE-2022-0687 HIGH POC
8.8 Mar 21

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user
CVE-2022-0627 MEDIUM POC
6.1 Mar 21

The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a
CVE-2022-0837 MEDIUM POC
5.4 Apr 04

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing

CVE-2022-0825 MEDIUM POC
5.4 Apr 04

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu
CVE-2022-0720 MEDIUM POC
5.4 Mar 28

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any cu
CVE-2026-57702 CRITICAL
9.3 Jul 13

Blind SQL injection in the Amelia booking plugin for WordPress (Melograno Venture Studio) affects all versions from unkn
CVE-2026-48889 HIGH
8.8 Jun 15

Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-p
CVE-2022-0616 MEDIUM POC
4.3 Mar 21

The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow a
CVE-2026-39487 HIGH
7.6 Apr 08

Blind SQL injection in Amelia WordPress plugin (ameliabooking) version 2.1.1 and earlier allows authenticated privileged
CVE-2026-40789 HIGH
7.5 Jun 15

Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows

CVE-2022-0834 HIGH
7.2 Mar 23

The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the l
CVE-2024-6332 MEDIUM
6.5 Sep 05

The Booking for Appointments and Events Calendar - Amelia Premium and Lite plugins for WordPress are vulnerable to unaut

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-22298 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy