VULNERABILITY INTELLIGENCE

CVE-2021-42948

CVSS score3.7 LOW

EPSS probability0.85%

CISA KEVNot currently listed

Published2022-09-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.

Weakness classification

nvd@nist.gov: CWE-319

Primary references

cve@mitre.org — Third Party Advisory
cve@mitre.org — Broken Link
cve@mitre.org — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory