CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.3.
Explanation of Vulnerability in Simple Terms
Ultimate Learning Pro versions 3.9.3 and earlier contain an authorization flaw that allows high-privileged users to modify data they should not have access to. The vulnerability requires an authenticated administrator account and does not affect data confidentiality or system availability. Site owners should update to a version newer than 3.9.3 when available.
What an attacker can do
A high-privileged user can modify data without proper authorization checks.
Potential impact on your site
Administrators may inadvertently modify protected data due to missing access controls.
Conditions required to exploit
Attacker must have administrator-level access to the site.
Key dates
External resources
