CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.
Explanation of Vulnerability in Simple Terms
Quiz And Survey Master through version 8.1.10 fails to properly check user permissions before allowing modifications to quiz and survey data. A logged-in user with low privileges can alter quiz settings, questions, or responses that they should not have access to. The vulnerability does not expose sensitive data or crash the site, but allows unauthorized changes to quiz content.
What an attacker can do
Modify quiz or survey data and settings without proper authorization.
Potential impact on your site
Quiz and survey content can be altered by users who should not have edit permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
