CVE-2020-28403

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28403
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403Third Party Advisory
https://www.starpracticemanagement.com/Product
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403Third Party Advisory
https://www.starpracticemanagement.com/Product

Timeline

Published: Jan 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-284046.5An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access t CVE-2020-284058.8An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change t CVE-2020-284066.5An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access d CVE-2020-284077.1In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a tempo CVE-2020-284085.4The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.CVE-2020-284095.4The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. oc CVE-2020-28418.2Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are a CVE-2020-284136.5In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.CVE-2020-284146.1A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker i CVE-2020-284156.1A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker i CVE-2020-284167.8HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and Off CVE-2020-284198.8During installation with certain driver software or application packages an arbitrary code execution could occur.