CVE-2021-42948

LOW

HotelDruid Hotel Management Software <3.0.3 - Info Disclosure

Title source: llm
STIX 2.1

Description

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.

References (3)

Core 3
Core References
Product, Vendor Advisory x_refsource_misc
https://www.hoteldruid.com/
Broken Link x_refsource_misc
https://github.com/dhammon/Security

Scores

CVSS v3 3.7
EPSS 0.0066
EPSS Percentile 46.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-319
Status published
Products (1)
digitaldruid/hoteldruid < 3.0.3
Published Sep 16, 2022
Tracked Since Feb 18, 2026