CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.
Explanation of Vulnerability in Simple Terms
ARMember versions up to 4.0.5 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the ARMember installation without the admin's knowledge or consent. The attacker has no special privileges and the victim must visit the malicious page, but successful exploitation can modify site settings or data.
What an attacker can do
Perform unwanted actions (modify settings, change data) on an ARMember site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker can alter ARMember configuration or user data if an admin visits a malicious link while logged in.
Conditions required to exploit
Victim must be logged into ARMember as an administrator and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
