CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.
Explanation of Vulnerability in Simple Terms
The Freetobook Responsive Widget versions 1.1 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the widget's settings or configuration. The vulnerability requires user interaction—the admin must visit the attacker's page—and does not expose sensitive data, but can modify widget behavior or settings.
What an attacker can do
Trick a site admin into visiting a malicious page that changes the widget's settings or configuration without their knowledge.
Potential impact on your site
An attacker can modify your Freetobook widget settings if they trick you into visiting their page while logged in.
Conditions required to exploit
The site admin must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
External resources
Related vulnerabilities
