CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
Explanation of Vulnerability in Simple Terms
Vimeotheque versions up to 2.3.5.2 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site visitors. An attacker can craft a malicious link or page that, when visited by a logged-in user, triggers unintended changes. The vulnerability requires user interaction and does not expose sensitive data, but can modify site content or settings.
What an attacker can do
Trick a logged-in user into performing unwanted actions on the site, such as changing settings or modifying content.
Potential impact on your site
Site visitors could unknowingly trigger changes to Vimeotheque settings or content if they click a malicious link while logged in.
Conditions required to exploit
Attacker must craft a malicious link or page and get a logged-in user to visit it.
Key dates
External resources
