CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Subscribe Form: from n/a through <= 1.2.2.
Explanation of Vulnerability in Simple Terms
Elastic Email Subscribe Form versions 1.2.2 and earlier lack proper authorization checks, allowing authenticated users to modify or delete data they should not have access to. An attacker with low-level account privileges can alter form settings or subscriber information without restriction. The vulnerability affects integrity and availability of form data but does not expose sensitive information.
What an attacker can do
Modify or delete form settings and subscriber data without proper authorization.
Potential impact on your site
Subscribers' data and form configurations can be altered or deleted by unauthorized users with basic site access.
Conditions required to exploit
Attacker must have a low-privilege account on the site with network access.
Key dates
External resources
Related vulnerabilities
