CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Marcus (aka @msykes) Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through <= 4.1.
Explanation of Vulnerability in Simple Terms
Login With Ajax versions 4.1 and earlier contain an authorization bypass that allows an attacker to modify data through user interaction. The vulnerability stems from missing access control checks on certain functions. An authenticated or unauthenticated user who clicks a malicious link can trigger unintended changes to site data. Update to a version newer than 4.1.
What an attacker can do
Modify site data by tricking a user into clicking a malicious link.
Potential impact on your site
Site data can be altered without proper authorization if users click attacker-controlled links.
Conditions required to exploit
User interaction required; attacker must trick a victim into visiting a crafted URL.
Key dates
External resources
Related vulnerabilities
