CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.
Explanation of Vulnerability in Simple Terms
myCred versions up to 2.9.4.3 contain a time-of-check-time-of-use (TOCTOU) vulnerability that allows an attacker to modify data integrity without authentication. The vulnerability exists in a race condition between validation and execution, enabling unauthorized changes to site data. Users should upgrade to version 3.1.2 or later.
What an attacker can do
Modify site data or settings without authentication by exploiting a race condition.
Potential impact on your site
Unauthorized changes to myCred data or configuration without admin approval or audit trail.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
