CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
Explanation of Vulnerability in Simple Terms
User Feedback through version 1.10.1 fails to properly check user permissions before allowing access to feedback data. A logged-in user with low privileges can read feedback submitted by other users, including potentially sensitive information. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Read feedback data submitted by other users on the site.
Potential impact on your site
User feedback intended to be private may be exposed to other registered users.
Conditions required to exploit
Attacker must have a low-privilege user account and network access to the site.
Key dates
External resources
Related vulnerabilities
