CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.
Explanation of Vulnerability in Simple Terms
Curly versions 3.3 and earlier contain an authorization flaw that allows authenticated users to modify data or disrupt service. An attacker with low-level access can alter content or cause the application to become unavailable. No public exploit is known. Update to a version newer than 3.3.
What an attacker can do
Modify data or cause service disruption on the site.
Potential impact on your site
Authenticated users can alter content or cause downtime without proper authorization.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
