CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through <= 1.9.
Explanation of Vulnerability in Simple Terms
Youtube Video Grid versions 1.9 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators without their knowledge. An attacker can craft a malicious link or page that, when visited by an admin, modifies site settings or data. No user interaction beyond visiting a page is required from the attacker's perspective, though the admin must be logged in.
What an attacker can do
Perform unauthorized actions on the site (modify settings, change data) by tricking an admin into visiting a malicious page.
Potential impact on your site
Site settings or content managed by Youtube Video Grid could be altered without admin consent if an admin visits a compromised or malicious page.
Conditions required to exploit
Target admin must be logged in and visit attacker-controlled content; no special privileges or authentication required from attacker.
Key dates
External resources
Related vulnerabilities
