CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects what3words Address Field: from n/a through <= 4.0.15.
Explanation of Vulnerability in Simple Terms
The what3words Address Field contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 4.0.15. An attacker can craft a malicious link or page that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction and can affect confidentiality, integrity, and availability of the affected component.
What an attacker can do
Perform unwanted actions on behalf of a logged-in user by tricking them into visiting a malicious page.
Potential impact on your site
Users' accounts could be compromised to perform unintended actions if they visit malicious links while logged in.
Conditions required to exploit
User must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
