CVE-2020-27379 - CVE House
Back to Database
Status published Medium CVE-2020-27379

Cross Site Request Forgery (CSRF) vulnerability in Booking Core -...

Vulnerability Description

Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-27379

Credits & Attribution

No credits recorded in the NVD database.

References

More from bookingcore

View All →
CVE-2021-37333
Laravel Booking System Booking Core 2.0 is vulnerable to Session...
Critical 9.8
CVE-2021-37331
Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect...
Medium 5.3
CVE-2021-37330
Laravel Booking System Booking Core 2.0 is vulnerable to Cross...
Medium 5.4
CVE-2020-25445
The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0...
High 7.8
CVE-2020-25444
Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate...
Medium 5.4

Affected Vendor

bookingcore

View all reports →

Affected Software

booking core
Vulnerable Versions:
1.7.0

Timeline

Official Publish: July 14th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.