CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
98.1%
# Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
# Exploit Author: William Summerhill
# Date: 2020-06-22
# Vendor homepage: https://www.globalradar.com/
# Tested on: Window
# CVE-2020-14943
# Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X
# are vulnerable to a stored Cross-Site Scripting (XSS) via the Update User Profile feature
# (in the top-right of the application).
# Proof of Concept:
Using the "update user profile" feature in the top-right of the application while logged in,
a malicious user can inject malicious, unencoded scripts, such as "<script>alert(1)</script>",
into the Firstname and Lastname parameters of a user account. This stored XSS will execute on
nearly every application page as these parameters are always present while logged in. This attack
can be further leveraged by utilizing an existing authorization bypass exploit (CVE-2020-14944)
to inject stored XSS payloads into these parameters for arbitrary existing user accounts.
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14943
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
98.1%