CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through <= 0.1.4.
Explanation of Vulnerability in Simple Terms
Avatar version 0.1.4 and earlier contains an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 0.1.4 to prevent unauthorized data modification.
What an attacker can do
Modify data or settings they should not have permission to change.
Potential impact on your site
Authenticated users can alter site data or configuration outside their intended permissions.
Conditions required to exploit
Attacker must have a valid user account on the site.
Key dates
External resources
Related vulnerabilities
