CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Leadinfo leadinfo. The patch was released under the same version which was reported as vulnerable. We consider the current version as vulnerable.This issue affects Leadinfo: from n/a through 1.0.
Explanation of Vulnerability in Simple Terms
Leadinfo versions up to 1.0 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability requires the user to visit a malicious webpage while authenticated. An attacker cannot read data or disrupt service, but can modify site content or settings through the victim's session.
What an attacker can do
Perform unauthorized actions (modify content or settings) on behalf of a logged-in user.
Potential impact on your site
Unauthorized changes to site content or settings if a user with Leadinfo access visits a malicious link.
Conditions required to exploit
Victim must be logged in and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
