CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.
Explanation of Vulnerability in Simple Terms
Quiz And Survey Master versions up to 10.3.3 lack proper authorization checks, allowing authenticated users to modify survey or quiz data they should not have access to. An attacker with a low-privilege account can alter quiz questions, answers, or survey responses. The vulnerability does not expose sensitive data or take the site offline, but compromises data integrity.
What an attacker can do
Modify quiz or survey content without proper authorization.
Potential impact on your site
Quiz and survey data can be altered by unauthorized users, affecting data accuracy and user trust.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
