CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
Explanation of Vulnerability in Simple Terms
Calculated Fields Form versions up to 5.3.58 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the form plugin without the admin's knowledge. The vulnerability requires user interaction—the admin must click the link or visit the attacker's page.
What an attacker can do
Perform unwanted actions on the form plugin by tricking an admin into clicking a malicious link.
Potential impact on your site
An attacker could modify form settings or data if an admin is tricked into visiting a malicious page.
Conditions required to exploit
Admin must be logged in and click a link or visit a page controlled by the attacker.
Key dates
External resources
