Vulnerability · Published Jun 22, 2020 · Assigned by mitre
CVE-2020-14944
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.3% (higher than 94% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)6.3%top 6.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.
Affected products (as reported)
References
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities x_refsource_MISC
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md x_refsource_MISC
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html x_refsource_MISC