CVE-2019-11488

HIGH 8.1CVE-2019-11488 · Published 25/04/2019 · updated 17/06/2026

In short

CVE-2019-11488 is a HIGH (CVSS 8.1) vulnerability affecting simplybook (simplybook).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.0% of all vulnerabilities.
Fix: update to 2019-04-23 or later.

Package	Affected versions	Patched versions
simplybook simplybook	`< 2019-04-23`	`2019-04-23`

Description

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history.

References

blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack · Exploit
cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf · Exploit

More vulnerabilities in simplybook

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free