by Kastro
Paper/Archive/CVE-2020-14944

CVE-2020-14944

mitre — Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions.

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.6.936 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/wsummerhill/BSA-Radar_CVE-Vulnerabilitiesrefgithub.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.mdrefpacketstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html