CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through <= 10.30.23.
Explanation of Vulnerability in Simple Terms
The Salon booking system contains an authorization flaw that allows authenticated users with low privileges to modify data they should not access. An attacker with a basic user account can alter booking records or other system information, potentially disrupting salon operations or affecting other users' reservations. The vulnerability requires valid login credentials but no special interaction from victims.
What an attacker can do
Modify booking records or other data without proper authorization.
Potential impact on your site
Salon bookings and customer data can be altered by any authenticated user, risking data integrity and operational disruption.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the system.
Key dates
External resources
