CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
What the vulnerability does
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
Explanation of Vulnerability in Simple Terms
Hotel Listing versions 1.4.2 and earlier lack proper authorization checks, allowing authenticated users to modify hotel listings and other data they should not have access to. An attacker with a low-privilege account can change listing details, availability, or pricing. The vulnerability affects confidentiality, integrity, and availability of hotel data. Update to a version newer than 1.4.2.
What an attacker can do
Modify or delete hotel listings and data belonging to other users or the site.
Potential impact on your site
Hotel data can be corrupted, deleted, or altered by unauthorized users with basic accounts.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
