Auth bypass in Vfairs
CVE-2020-26679
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.008 (54.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Vfairs — versions 3.3
Weakness classification (CWE)
References
- af854a3a-2127-422b-91ae-364da2661108 (Vendor Advisory)
- api.vfairs.com/v1/profiles (Vendor Advisory)
- api.vfairs.com/v1/profiles (Vendor Advisory)
- www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-plat… (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26679?
- CVE-2020-26679 is a medium-severity vulnerability in Vfairs, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2021-05-26.
- How severe is CVE-2020-26679?
- Medium severity. CVSS v3 base score is 4.3 out of 10.