Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2022-26564

HistoryApr 26, 2022 - 11:15 p.m.

CVE-2022-26564

2022-04-2623:15:44

Debian Security Bug Tracker

security-tracker.debian.org

hoteldruid managementsoftware xssvulnerability creaprezzi.php_unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.8%

JSON

HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.

OSVersionArchitecturePackageVersionFilename
Debian12allhoteldruid< 3.0.4-1hoteldruid_3.0.4-1_all.deb
Debian11allhoteldruid<= 3.0.1-1hoteldruid_3.0.1-1_all.deb
Debian999allhoteldruid< 3.0.4-1hoteldruid_3.0.4-1_all.deb
Debian13allhoteldruid< 3.0.4-1hoteldruid_3.0.4-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	hoteldruid	< 3.0.4-1	hoteldruid_3.0.4-1_all.deb
Debian	11	all	hoteldruid	<= 3.0.1-1	hoteldruid_3.0.1-1_all.deb
Debian	999	all	hoteldruid	< 3.0.4-1	hoteldruid_3.0.4-1_all.deb
Debian	13	all	hoteldruid	< 3.0.4-1	hoteldruid_3.0.4-1_all.deb

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.8%

JSON

Related for DEBIANCVE:CVE-2022-26564