Vulnerability Details CVE-2020-14944
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.118
EPSS Ranking 93.5%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md
Products affected by CVE-2020-14944
-
cpe:2.3:a:globalradar:bsa_radar:-
-
cpe:2.3:a:globalradar:bsa_radar:1.6.7234.24750