CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Authorsy: from n/a through <= 1.0.6.
Explanation of Vulnerability in Simple Terms
Authorsy versions 1.0.6 and earlier contain an authorization flaw that exposes sensitive information to unauthenticated attackers over the network. The vulnerability requires no user interaction and can be exploited remotely without authentication. An attacker can read confidential data but cannot modify or disable the application.
What an attacker can do
Read sensitive information without logging in or user interaction.
Potential impact on your site
Confidential data may be exposed to anyone on the internet if Authorsy is publicly accessible.
Conditions required to exploit
Network access to the affected Authorsy installation; no authentication required.
Key dates
External resources
