Lucene search

MitreCVE-2020-14943

HistoryJun 22, 2020 - 10:15 p.m.

CVE-2020-14943

2020-06-2222:15:12

CWE-79

mitre

web.nvd.nist.gov

cve-2020-14943

global radar

bsa radar

xss

update user profile

security vulnerability

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile.

Affected configurations

Nvd

Node

globalradarbsa_radarRange≤1.6.7234.24750

VendorProductVersionCPE
globalradarbsa_radar*cpe:2.3:a:globalradar:bsa_radar:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
globalradar	bsa_radar	*	cpe:2.3:a:globalradar:bsa_radar::::::::

References

packetstormsecurity.com/files/158217/BSA-Radar-1.6.7234.24750-Cross-Site-Scripting.html

github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities

github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14943%20-%20Stored%20XSS.md

www.exploit-db.com/exploits/48619

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

Related for CVE-2020-14943