CVE-2020-27379 — MEDIUM (6.5)

Vulnerability Description

Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Bookingcore	Booking Core	1.7.0

Related Weaknesses (CWE)

CWE-352

References

FAQ

What is CVE-2020-27379?

CVE-2020-27379 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This resu...

How severe is CVE-2020-27379?

CVE-2020-27379 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-27379?

Check the references section above for vendor advisories and patch information. Affected products include: Bookingcore Booking Core.