CVE-2020-28403

A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application.

CVSS v3 8.0 HIGH
CVSS v2.0 6.8 MEDIUM

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403	Third Party Advisory
https://www.starpracticemanagement.com/	Product
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403	Third Party Advisory
https://www.starpracticemanagement.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:iris:star:2019.2.0.6:*:*:*:*:*:*:*

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
References	~~() https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403 - Third Party Advisory~~	() https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403 - Third Party Advisory
References	~~() https://www.starpracticemanagement.com/ - Product~~	() https://www.starpracticemanagement.com/ - Product
CVSS	v2 : ~~6.8~~ v3 : ~~8.8~~	v2 : 6.8 v3 : 8.0

Information

Published : 2021-01-29 07:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28403

Mitre link : CVE-2020-28403

CVE.ORG link : CVE-2020-28403

JSON object : View

Products Affected

iris

star

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2020-28403", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-01-29T07:15:16.390", "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.starpracticemanagement.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.starpracticemanagement.com/", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en Star Practice Management Web versi\u00f3n 2019.2.0.6, que permite a un atacante cambiar los privilegios de cualquier usuario de la aplicaci\u00f3n. Esto puede ser usado para otorgarse un rol administrativo o eliminar la cuenta administrativa de la aplicaci\u00f3n"}], "lastModified": "2024-11-21T05:22:44.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iris:star:2019.2.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA4E68A0-F7AB-4470-9ED3-8441C5A8881C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}