CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
Explanation of Vulnerability in Simple Terms
Quiz And Survey Master versions up to 10.3.4 lack proper authorization checks, allowing authenticated users to modify quiz or survey data they should not have access to. An attacker with a low-privilege account can alter quiz settings, questions, or responses without permission. The vulnerability affects the integrity of quiz data but does not expose sensitive information or cause service disruption.
What an attacker can do
Modify quiz or survey data belonging to other users or administrators.
Potential impact on your site
Quiz and survey data integrity is at risk; users may alter quizzes they don't own.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
