CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through <= 1.1.3.
Explanation of Vulnerability in Simple Terms
The Multi Days Events and Multi Events in One Day Calendar plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unauthorized calendar operations. The vulnerability affects versions up to 1.1.3 and requires no special privileges, only that an admin click a malicious link.
What an attacker can do
Perform unwanted calendar actions on behalf of an admin who visits a malicious link.
Potential impact on your site
Attackers can modify or delete calendar events without your knowledge if an admin is tricked into visiting a malicious page.
Conditions required to exploit
Admin must visit attacker-controlled page or click a malicious link while logged in.
Key dates
External resources
