CVE-2021-42948

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.

CVSS v3.1

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.72% chance of exploitation in the next 30 days, 51th percentile

Published

2022-09-16

Updated

2024-08-04

Proof-of-concept exploits (1)

• dhammon/HotelDruid-CVE-2021-429480★ · 2022-02-19

References

• CVE Record
• NVD entry

Related

• CVE-2021-42949
• CVE-2022-40624
• CVE-2021-42943
• CVE-2021-42917
• CVE-2021-42954
• CVE-2021-42913