CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Packlink Shipping S.L. Packlink PRO shipping module allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Packlink PRO shipping module: from n/a through 3.4.6.
Explanation of Vulnerability in Simple Terms
The Packlink PRO shipping module through version 3.4.6 lacks proper authorization checks, allowing authenticated users with low privileges to modify shipping data and settings they should not access. An attacker with a basic user account can alter integrity of shipping operations without administrative approval. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify shipping data and settings without proper authorization as a low-privilege authenticated user.
Potential impact on your site
Unauthorized users can alter shipping configurations, potentially disrupting order fulfillment and causing data integrity issues.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
