Lucene search

Fluid AttacksCVELIST:CVE-2023-49272

HistoryDec 20, 2023 - 7:25 p.m.

CVE-2023-49272 Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)

2023-12-2019:25:08

CWE-79

Fluid Attacks

www.cve.org

cross-site scripting

hotel management

vulnerable.

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

Percentile

14.0%

JSON

Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The ‘children’ parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application’s response.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Hotel Management",
    "vendor": "Kashipara Group",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/lang/

www.kashipara.com/

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

Percentile

14.0%

JSON

Related for CVELIST:CVE-2023-49272