CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.This issue affects LTL Freight Quotes - TQL Edition: from n/a through <= 1.2.6.
Explanation of Vulnerability in Simple Terms
The LTL Freight Quotes - TQL Edition plugin contains a deserialization vulnerability in versions up to 1.2.6. An attacker with high-level privileges can send a specially crafted request to deserialize untrusted data, potentially gaining read and write access to sensitive site data or disrupting service availability. Site administrators should update immediately to a patched version.
What an attacker can do
Read and modify sensitive data, or disrupt site availability by deserializing malicious objects.
Potential impact on your site
A compromised admin account could lead to data theft, unauthorized modifications, or site downtime.
Conditions required to exploit
Attacker must have high-level administrative or privileged account access to the site.
Key dates
External resources
Related vulnerabilities
