CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue affects Bitly URL Shortener: from n/a through <= 1.4.1.
Explanation of Vulnerability in Simple Terms
Bitly URL Shortener versions up to 1.4.1 contain a cross-site request forgery vulnerability. An attacker can craft a malicious link that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction—the victim must click the attacker's link. Impact is limited to integrity (data modification), not confidentiality or availability.
What an attacker can do
Perform unwanted actions on a user's account when they click a malicious link while logged in.
Potential impact on your site
Users' shortened URL configurations or account settings could be modified without their knowledge if they click malicious links.
Conditions required to exploit
User must be logged in and click an attacker-crafted link; no special privileges required.
Key dates
External resources
