{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-09T21:47:29.991","vulnerabilities":[{"cve":{"id":"CVE-2020-27379","sourceIdentifier":"cve@mitre.org","published":"2021-07-14T15:15:08.130","lastModified":"2024-11-21T05:21:07.617","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID."},{"lang":"es","value":"Una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) en Booking Core - Ultimate Booking System Booking Core versión 1.7.0. El token CSRF no esta siendo comprobado cuando la petición es enviada como método GET. Esto resulta en un cambio no autorizado en el ID de correo electrónico del usuario, que posteriormente puede ser usado para restablecer la contraseña. La nueva contraseña se enviará a un ID de correo electrónico modificado"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bookingcore:booking_core:1.7.0:*:*:*:*:*:*:*","matchCriteriaId":"BBAECB94-1670-484C-8089-49FE148D1565"}]}]}],"references":[{"url":"https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","source":"cve@mitre.org"},{"url":"https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}