Lucene search

Fluid AttacksCVELIST:CVE-2023-49271

HistoryDec 20, 2023 - 7:24 p.m.

CVE-2023-49271 Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)

2023-12-2019:24:15

CWE-79

Fluid Attacks

www.cve.org

hotel management v1.0

cross-site scripting

reflected

authentication

vulnerability

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

Percentile

14.0%

JSON

Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The ‘check_out_date’ parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application’s response.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Hotel Management",
    "vendor": "Kashipara Group",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/lang/

www.kashipara.com/

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

Percentile

14.0%

JSON

Related for CVELIST:CVE-2023-49271