PT-2020-14079 · Global Radar · Global Radar Bsa Radar

William Summerhill · Published 2020-06-22 · Updated 2023-01-27 · CVE-2020-14943

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Global RADAR BSA Radar versions 1.6.7234.24750 and earlier

Description The issue concerns stored cross-site scripting (XSS) via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable.

Recommendations For Global RADAR BSA Radar versions 1.6.7234.24750 and earlier, consider restricting the use of the Firstname and Lastname parameters in the Update User Profile feature until a fix is available. Avoid using these parameters to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14943

Affected Products

Global Radar Bsa Radar

References · 6

• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14943%20-%20Stored%20XSS.md · Exploit
• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities · Exploit
• 🔥 http://packetstormsecurity.com/files/158217/BSA-Radar-1.6.7234.24750-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/48619 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14943 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14943 · Vendor Advisory