CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Яндекс Доставка (Boxberry): from n/a through <= 2.34.
Explanation of Vulnerability in Simple Terms
Boxberry (Яндекс Доставка), a delivery integration module, contains an authorization flaw in versions up to 2.34. An authenticated user with low privileges can modify or disable delivery functionality without proper permission checks. The vulnerability affects data integrity and service availability but does not expose sensitive information.
What an attacker can do
Modify or disable delivery service settings and data without proper authorization.
Potential impact on your site
Authenticated users can tamper with delivery configurations, potentially disrupting order fulfillment or customer shipping options.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
