CVE-2020-27379

{"id": "CVE-2020-27379", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-07-14T15:15:08.130", "references": [{"url": "https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) en Booking Core - Ultimate Booking System Booking Core versi\u00f3n 1.7.0. El token CSRF no esta siendo comprobado cuando la petici\u00f3n es enviada como m\u00e9todo GET. Esto resulta en un cambio no autorizado en el ID de correo electr\u00f3nico del usuario, que posteriormente puede ser usado para restablecer la contrase\u00f1a. La nueva contrase\u00f1a se enviar\u00e1 a un ID de correo electr\u00f3nico modificado"}], "lastModified": "2023-11-07T03:20:56.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bookingcore:booking_core:1.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBAECB94-1670-484C-8089-49FE148D1565"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}