What is CVE-2023-37919?

CVE-2023-37919 is a medium-severity vulnerability in Cal Cal.com, classified under Insufficient Session Expiration. CVSS score: 6.5/10. Published 2023-07-25.

How severe is CVE-2023-37919?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Cal Cal.com

CVE-2023-37919

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.

EPSS: 0.003 (23.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Cal Cal.com
Calcom Cal.com — versions <= 3.1.4

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-37919?: CVE-2023-37919 is a medium-severity vulnerability in Cal Cal.com, classified under Insufficient Session Expiration. CVSS score: 6.5/10. Published 2023-07-25.
How severe is CVE-2023-37919?: Medium severity. CVSS v3 base score is 6.5 out of 10.