CVE-2021-42948

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dhammon/HotelDruid-CVE-2021-42948Third Party Advisory
https://github.com/dhammon/SecurityBroken Link
https://www.hoteldruid.com/Product, Vendor Advisory
https://github.com/dhammon/HotelDruid-CVE-2021-42948Third Party Advisory
https://github.com/dhammon/SecurityBroken Link
https://www.hoteldruid.com/Product, Vendor Advisory

Timeline

Published: Sep 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-429499.8The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attack CVE-2021-42959.8A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabula CVE-2021-429508.8Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an a CVE-2021-429518.8A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for a CVE-2021-429529.9Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, use CVE-2021-429547.8Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation direc CVE-2021-429557.8Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability CVE-2021-429568.8Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. CVE-2021-42966.1A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of t CVE-2021-429679.8Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows a CVE-2021-429698.8Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write s CVE-2021-42979.8A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_pos