CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.
Explanation of Vulnerability in Simple Terms
Stackable versions up to 3.18.1 expose sensitive information to authenticated users with low privileges. An attacker with a basic user account can read data they should not have access to. The vulnerability requires network access and an active login but no additional user interaction. Update to a version newer than 3.18.1 to resolve this issue.
What an attacker can do
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
User data and site information may be exposed to any authenticated user, even those with minimal permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
