CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through <= 3.2.2.
Explanation of Vulnerability in Simple Terms
Inactive Logout versions 3.2.2 and earlier lack proper authorization checks, allowing authenticated users to modify or disable logout functionality for other users. An attacker with low-privilege access can alter site behavior and availability. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify or disable logout settings for other users on the site.
Potential impact on your site
Authenticated users may lose control of their session management, affecting site stability and user experience.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
