PT-2020-14080 · Global Radar · Global Radar Bsa Radar

William Summerhill · Published 2020-06-22 · Updated 2022-05-03 · CVE-2020-14944

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Global RADAR BSA Radar versions 1.6.7234.24750 and earlier

Description The issue lacks valid authorization controls in multiple functions, which can allow for manipulation and takeover of user accounts if successfully exploited. The vulnerable functions exposed are: ChangePassword, SaveUserProfile, and GetUser.

Recommendations For Global RADAR BSA Radar versions 1.6.7234.24750 and earlier, consider disabling the ChangePassword, SaveUserProfile, and GetUser functions until a patch is available to prevent potential exploitation. Restrict access to these functions to minimize the risk of account manipulation and takeover.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-14944

Affected Products

Global Radar Bsa Radar

References · 6

• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md · Exploit
• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities · Exploit
• 🔥 http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/48653 · Exploit
• https://osv.dev/vulnerability/CVE-2020-14944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14944 · Security Note