CVE-2015-2858

Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.

Score

CVSS 2.0 7.5 High

Status

Modified - cret@cert.org

Published

2015-10-02

Last modified

2024-08-06

Affected products

• Airline Booking Software (Datalex)

References

• http://www.kb.cert.org/vuls/id/693036