CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.0.4.
Explanation of Vulnerability in Simple Terms
AnyTrack Affiliate Link Manager versions 1.0.4 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify affiliate link data and settings. An attacker can send network requests to change link targets, commission rates, or other configuration without logging in. This affects all installations running the vulnerable version.
What an attacker can do
Modify or delete affiliate links and settings without authentication.
Potential impact on your site
Affiliate links could be redirected to attacker-controlled destinations, commission rates altered, or tracking data corrupted.
Conditions required to exploit
Network access to the AnyTrack installation; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
