CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
Explanation of Vulnerability in Simple Terms
The iCount Payment Gateway through version 2.0.7 lacks proper authorization checks, allowing unauthenticated attackers to modify payment-related data over the network. No user interaction is required. The vulnerability affects data integrity but not confidentiality or availability. Organizations using this payment gateway should update immediately.
What an attacker can do
Modify payment gateway data without authentication.
Potential impact on your site
Attackers can alter payment records, transactions, or settings without logging in.
Conditions required to exploit
Network access to the payment gateway; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
