CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.
Explanation of Vulnerability in Simple Terms
Multi Step Form versions 1.7.21 and earlier lack proper authorization checks, allowing authenticated users to modify form data they should not have access to. An attacker with a low-privilege account can alter form submissions or settings belonging to other users or forms. The vulnerability requires an existing user account but no special interaction from victims.
What an attacker can do
Modify form data or settings belonging to other users or forms.
Potential impact on your site
Users' form submissions and form configurations can be altered by other authenticated users without authorization.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
