CVE-2019-9084
Medium
Description
In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to conduct remote denial of service (disrupting certain business functions of the product).
SeverityMedium
CVSS4.9
Exploit probability—
ProductDigitaldruid Hoteldruid
PublishedJun 7, 2019
First seenJun 7, 2019
How to fix
Update
- digitaldruid hoteldruid2.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digitaldruid hoteldruid | v < 2.3.1 | 2.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.