Lucene search

[email protected]CVE-2023-39423

HistorySep 07, 2023 - 1:15 p.m.

CVE-2023-39423

2023-09-0713:15:08

CWE-89

[email protected]

web.nvd.nist.gov

2376

rdpdata.dll

sql injection

session ids

impersonation

security vulnerability

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.

Affected configurations

NVD

Node

resortdatainternet_reservation_module_next_generationMatch5.3.2.15

CPENameOperatorVersion
resortdata:internet_reservation_module_next_generationresortdata internet reservation module next generationeq5.3.2.15

CPE	Name	Operator	Version
resortdata:internet_reservation_module_next_generation	resortdata internet reservation module next generation	eq	5.3.2.15

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "RDPData.dll"
    ],
    "product": "IRM Next Generation",
    "vendor": "Resort Data Processing, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "5.3.2.15"
      }
    ]
  }
]

References

bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2023-39423

prion1 nvd1 cvelist1