CVE-2020-36126
Published: 07 May 2021
Summary
CVE-2020-36126 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Paxtechnology Paxstore. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-23704
Vulnerability details
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and…
more
payment terminals, where an attacker can impersonate any user which may lead to the unauthorized disclosure, modification, or destruction of information.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.