CVEvulnerability
CVE-2020-14944
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-06-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-862
Description
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.
Affected configurations
• globalradar bsa radar (<= 1.6.7234.24750)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities Third Party Advisory
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities Third Party Advisory
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md Exploit, Third Party Advisory