CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
Explanation of Vulnerability in Simple Terms
Minimalistic Event Manager versions 1.1.1 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify or disable event data and functionality. The vulnerability affects the entire application scope due to changed scope impact. No confidentiality breach occurs, but integrity and availability of events can be compromised by low-privileged attackers without user interaction.
What an attacker can do
Modify or disable events and event data without proper authorization.
Potential impact on your site
Low-privilege users can alter or disable events, affecting site reliability and data integrity.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
