CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.
Explanation of Vulnerability in Simple Terms
JS Help Desk versions up to 3.0.3 contain an authorization flaw that allows authenticated users to read sensitive information they should not have access to. The vulnerability requires a valid user account but no additional user interaction. An attacker with low-privilege credentials can view confidential data within the help desk system.
What an attacker can do
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
Confidential help desk data may be exposed to any authenticated user, including support tickets or internal notes.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
