CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Explanation of Vulnerability in Simple Terms
KiviCare versions before 4.5.5 contain an information disclosure vulnerability accessible over the network without authentication. An attacker can read sensitive data from the application. The vulnerability requires no user interaction and affects confidentiality but not integrity or availability. Update to version 4.5.5 or later to resolve this issue.
What an attacker can do
Read sensitive information from the application without logging in.
Potential impact on your site
Sensitive data may be exposed to unauthenticated attackers on the internet.
Conditions required to exploit
Network access to the KiviCare instance; no authentication required.
Key dates
External resources
