VulnerabilityModified
CVE-2020-14944
This can allow for manipulation and takeover of user accounts if successfully exploited.
CRITICAL 9.8EPSS 6.34%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.34% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- globalradar/bsa radar
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/wsummerhill/BSA-Radar_CVE-VulnerabilitiesThird Party Advisory
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.mdExploit, Third Party Advisory
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/wsummerhill/BSA-Radar_CVE-VulnerabilitiesThird Party Advisory
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.