CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
Explanation of Vulnerability in Simple Terms
Eagle Booking versions up to 1.3.4.3 lack proper authorization checks, allowing authenticated users to modify or delete booking data they should not have access to. An attacker with a low-privilege account can change or remove bookings belonging to other users or the site. This affects data integrity and availability for booking operations.
What an attacker can do
Modify or delete bookings belonging to other users without proper authorization.
Potential impact on your site
Booking data can be corrupted or deleted by unauthorized users, disrupting reservations and customer trust.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
