CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.
Explanation of Vulnerability in Simple Terms
Constant Contact Forms versions up to 2.0.3 lack proper authorization checks, allowing authenticated users to modify form data they should not have access to. An attacker with a low-privilege account can alter form settings or content belonging to other users or forms. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify form data and settings belonging to other users or forms.
Potential impact on your site
Unauthorized users can alter or corrupt forms managed by other team members or administrators.
Conditions required to exploit
Attacker must have a valid low-privilege account on the site.
Key dates
External resources
Related vulnerabilities
