CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.
Explanation of Vulnerability in Simple Terms
Admin and Site Enhancements (ASE) Pro versions up to 7.6.1.1 lack proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability does not affect confidentiality or availability, only data integrity. Update to a version newer than 7.6.1.1.
What an attacker can do
A low-privilege logged-in user can modify data they should not have permission to change.
Potential impact on your site
Unauthorized users may alter site content, settings, or other data depending on which functions lack authorization checks.
Conditions required to exploit
Attacker must have a low-privilege account on the site and network access to the application.
Key dates
External resources
Related vulnerabilities
