CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.
Explanation of Vulnerability in Simple Terms
Zephyr Project Manager versions 3.3.200 and earlier lack proper authorization checks, allowing authenticated users to read and modify data they should not have access to. An attacker with a low-privilege account can view or alter sensitive project information without the appropriate permissions. This affects confidentiality and integrity of stored data.
What an attacker can do
Read and modify project data belonging to other users or restricted areas.
Potential impact on your site
Unauthorized data disclosure and modification of project records by authenticated users with insufficient permissions.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the Zephyr instance.
Key dates
External resources
Related vulnerabilities
