CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.
Explanation of Vulnerability in Simple Terms
Affiliate Toolkit versions 3.7.3 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and does not expose sensitive data, but can modify site settings or data.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the site via a malicious link or webpage.
Potential impact on your site
An admin's session can be hijacked to change settings, modify data, or perform other actions without their consent.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into the site; no special privileges or authentication required from attacker.
Key dates
External resources
Related vulnerabilities
