CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in SwiftXR SwiftXR (3D/AR/VR) Viewer swiftxr-3darvr-viewer allows Cross Site Request Forgery.This issue affects SwiftXR (3D/AR/VR) Viewer: from n/a through <= 1.0.7.
Explanation of Vulnerability in Simple Terms
SwiftXR Viewer versions 1.0.7 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions within the viewer without the user's knowledge. The vulnerability requires user interaction—the victim must visit the attacker's page—but can modify data or trigger functions within the application.
What an attacker can do
Perform unwanted actions (modify data, trigger functions) in the viewer on behalf of a logged-in user.
Potential impact on your site
Users' accounts and data in SwiftXR Viewer can be manipulated without their consent if they visit a malicious link.
Conditions required to exploit
User must visit an attacker-controlled webpage while logged into SwiftXR Viewer.
Key dates
External resources
Related vulnerabilities
