CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
Explanation of Vulnerability in Simple Terms
PostmarkApp Email Integrator versions 2.4 and earlier lack proper authorization checks, allowing authenticated users to modify email settings or configurations they should not have access to. The vulnerability requires a valid user account but does not require administrator privileges. An attacker with low-level access can alter email integration settings, potentially disrupting email delivery or redirecting messages.
What an attacker can do
Modify email integrator settings or configurations without proper authorization.
Potential impact on your site
Unauthorized users could alter email settings, disrupt email delivery, or redirect messages to attacker-controlled addresses.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
