CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.
Explanation of Vulnerability in Simple Terms
Trustindex Widgets for Social Photo Feed versions 1.8 and earlier fail to properly check user permissions before allowing access to sensitive data. An unauthenticated attacker can read information that should be restricted, such as private feed settings or configuration details. Update to a version newer than 1.8 to resolve this issue.
What an attacker can do
Read restricted feed settings and configuration data without authentication.
Potential impact on your site
Sensitive feed configuration and private settings may be exposed to anyone on the internet.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
