CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.2.1.
Explanation of Vulnerability in Simple Terms
SendPulse Email Marketing Newsletter versions up to 2.2.1 expose sensitive information to authenticated users. An attacker with low-level account access can read data they should not have permission to view. The vulnerability requires login credentials but no additional user interaction. Update to a version newer than 2.2.1 to resolve this issue.
What an attacker can do
Read sensitive data they should not have access to within the SendPulse application.
Potential impact on your site
Users' sensitive information may be exposed to other authenticated accounts on your SendPulse instance.
Conditions required to exploit
Attacker must have a valid SendPulse account with low-level privileges.
Key dates
External resources
Related vulnerabilities
