CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through <= 2.0.
Explanation of Vulnerability in Simple Terms
Infusionsoft Analytics versions 2.0 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated. Impact is limited to data integrity and availability; no sensitive data can be read.
What an attacker can do
Perform unwanted actions on a user's account by tricking them into visiting a malicious webpage.
Potential impact on your site
Users' accounts can be manipulated without their knowledge if they visit untrusted sites while logged in.
Conditions required to exploit
User must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
External resources
Related vulnerabilities
