Vulnerability in Datalex Airline Booking Software
CVE-2015-2858
Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.
EPSS: 0.015 (71.9th percentile) — read the EPSS interpretation.
Affected products
- Datalex Airline_booking_software
- N/a — versions n/a
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)