CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.
Explanation of Vulnerability in Simple Terms
MasterStudy LMS versions up to 3.2.1 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of authenticated users. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator or user, executes unintended operations without their knowledge or consent. The vulnerability requires user interaction—the victim must click a link or visit a page—but no special privileges are needed to craft the attack.
What an attacker can do
Perform unwanted actions on behalf of a logged-in user without their knowledge.
Potential impact on your site
Attackers can trick administrators or users into performing unintended actions like changing settings, creating accounts, or modifying course content.
Conditions required to exploit
Victim must be logged into MasterStudy LMS and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
