CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.This issue affects Complianz: from n/a through 6.4.5; Complianz Premium: from n/a through 6.4.7.
Explanation of Vulnerability in Simple Terms
Complianz versions up to 6.4.5 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted changes to the plugin's settings or configuration. No authentication is required from the attacker, but the admin must click the link or visit the page.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into clicking a malicious link.
Potential impact on your site
Attackers can modify Complianz settings or configuration without your permission if you click a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled page or click a malicious link while logged in.
Key dates
External resources
Related vulnerabilities
