Lucene search

MitreCVE-2020-23832

HistoryOct 06, 2020 - 1:15 p.m.

CVE-2020-23832

2020-10-0613:15:13

CWE-79

mitre

web.nvd.nist.gov

cve-2020-23832

cross-site scripting

xss

car rental management system

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.005

Percentile

76.5%

JSON

A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.

Affected configurations

Nvd

Node

car_rental_management_system_projectcar_rental_management_systemMatch1.0

VendorProductVersionCPE
car_rental_management_system_projectcar_rental_management_system1.0cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
car_rental_management_system_project	car_rental_management_system	1.0	cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:::::::*

References

github.com/projectworlds32/Car-Rental-Syatem-PHP-MYSQL/archive/master.zip

packetstormsecurity.com/files/158795/Car-Rental-Management-System-1.0-Cross-Site-Scripting.html

projectworlds.in

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.005

Percentile

76.5%

JSON

Related for CVE-2020-23832