CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through <= 2.1.8.
Explanation of Vulnerability in Simple Terms
Event Kikfyre versions 2.1.8 and earlier lack proper authorization checks, allowing authenticated users to modify or disable site features. An attacker with a low-privilege account can alter event settings or disable functionality without proper permission validation. This affects data integrity and site availability but does not expose sensitive information.
What an attacker can do
Modify or disable event settings and site features without proper authorization.
Potential impact on your site
Unauthorized users can alter event configurations or disable features, disrupting site operations.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
