CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.
Explanation of Vulnerability in Simple Terms
Sugar Calendar (Lite) versions up to 3.9.1 lack proper authorization checks on certain operations. A logged-in user with low privileges can modify calendar data they should not have access to. The vulnerability requires an active user account but no special interaction from victims. Update to a version newer than 3.9.1 to resolve this issue.
What an attacker can do
Modify calendar data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter calendar events, schedules, or configuration.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
