CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
Explanation of Vulnerability in Simple Terms
LiquidPoll versions up to 3.3.68 lack proper authorization checks, allowing authenticated users to modify poll data they should not have access to. An attacker with a low-privilege account can alter poll settings or results without permission. The vulnerability requires an existing user account but does not require administrator privileges. Update to a version newer than 3.3.68 to resolve this issue.
What an attacker can do
Modify poll data or settings belonging to other users or administrators.
Potential impact on your site
Polls can be tampered with by any authenticated user, compromising poll integrity and data accuracy.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
