Vulnerability Details CVE-2023-39422
The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 20.5%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2023-39422
-
cpe:2.3:a:resortdata:internet_reservation_module_next_generation:-