{"api_version":"1","generated_at":"2026-07-23T13:15:56+00:00","cve":"CVE-2020-14944","urls":{"html":"https://cve.report/CVE-2020-14944","api":"https://cve.report/api/cve/CVE-2020-14944.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-14944","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-14944"},"summary":{"title":"CVE-2020-14944","description":"Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-06-22 22:15:00","updated_at":"2022-05-03 13:59:00"},"problem_types":["CWE-862"],"metrics":[],"references":[{"url":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities","name":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities","refsource":"MISC","tags":["Third Party Advisory"],"title":"GitHub - wsummerhill/BSA-Radar_CVE-Vulnerabilities: CVE submissions for the Global Radar - BSA Radar banking application","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md","name":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"BSA-Radar_CVE-Vulnerabilities/CVE-2020-14944 - Access Control Vulnerabilities.md at master · wsummerhill/BSA-Radar_CVE-Vulnerabilities · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html","name":"http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html","refsource":"MISC","tags":[],"title":"BSA Radar 1.6.7234.24750 Cross Site Request Forgery ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14944","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14944","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"14944","vulnerable":"1","versionEndIncluding":"1.6.7234.24750","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"globalradar","cpe5":"bsa_radar","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-14944","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities","url":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities"},{"refsource":"MISC","name":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md","url":"https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html","url":"http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html"}]}},"nvd":{"publishedDate":"2020-06-22 22:15:00","lastModifiedDate":"2022-05-03 13:59:00","problem_types":["CWE-862"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:globalradar:bsa_radar:*:*:*:*:*:*:*:*","versionEndIncluding":"1.6.7234.24750","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"14944","Ordinal":"176322","Title":"CVE-2020-14944","CVE":"CVE-2020-14944","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"14944","Ordinal":"1","NoteData":"Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"14944","Ordinal":"2","NoteData":"2020-06-22","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"14944","Ordinal":"3","NoteData":"2020-07-09","Type":"Other","Title":"Modified"}]}}}