CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
What the vulnerability does
Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated users into visiting malicious pages. Attackers can craft HTML forms targeting the account/index endpoint with hidden fields to change passwords, email addresses, and profile details without user consent.
Explanation of Vulnerability in Simple Terms
Jomres contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability affects versions 9.11.2 and requires the victim to be logged in. An attacker can modify site data or settings by tricking a logged-in administrator or user into visiting a malicious page.
What an attacker can do
Perform unauthorized actions (modify data, change settings) on behalf of a logged-in user without their knowledge.
Potential impact on your site
Administrators or users could unknowingly authorize changes to site configuration, user accounts, or booking data via CSRF attacks.
Conditions required to exploit
Target user must be logged into Jomres; attacker must trick them into visiting a malicious page or clicking a link.
Key dates
External resources
Related vulnerabilities
