CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Explanation of Vulnerability in Simple Terms
Hospital Doctor Directory versions up to 1.3.9 lack proper authorization checks, allowing unauthenticated attackers to read, modify, or delete sensitive data without logging in. The vulnerability affects the core functionality of the plugin and requires no special setup to exploit. Site administrators should update immediately to a version newer than 1.3.9.
What an attacker can do
Read, modify, or delete sensitive data in the Hospital Doctor Directory without authentication.
Potential impact on your site
Unauthorized users can access, alter, or remove doctor directory information and potentially other sensitive data.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
