CVE-2020-14944 - Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions

Back Back to CVE browser

CRITICAL

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions

Published Jun 22, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 6.34%

Description

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities
x_refsource_MISCThird Party Advisory
https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities		x_refsource_MISCThird Party Advisory
https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md		x_refsource_MISCExploitThird Party Advisory