CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Explanation of Vulnerability in Simple Terms
Behance Portfolio Manager versions 1.7.5 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. The attack requires the victim to visit the attacker's page while authenticated.
What an attacker can do
Perform actions on the site (create, modify, or delete content) on behalf of a logged-in administrator without their consent.
Potential impact on your site
An attacker can trick your administrators into unknowingly making changes to your site's portfolio or settings.
Conditions required to exploit
A logged-in site administrator must visit a malicious webpage controlled by the attacker.
Key dates
External resources
Related vulnerabilities
