CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Juni Hestia Nginx Cache hestia-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hestia Nginx Cache: from n/a through <= 2.4.0.
Explanation of Vulnerability in Simple Terms
Hestia Nginx Cache versions 2.4.0 and earlier lack proper authorization checks, allowing an unauthenticated attacker to modify cached content or settings through a crafted request. The attacker must trick a site visitor into clicking a malicious link or visiting a compromised page. This affects data integrity but not confidentiality or availability.
What an attacker can do
Modify cached content or cache settings without authentication.
Potential impact on your site
Cached pages could be poisoned with malicious content served to visitors until cache expires.
Conditions required to exploit
No login required. Victim must click a malicious link or visit attacker-controlled page.
Key dates
External resources
Related vulnerabilities
