CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.
Explanation of Vulnerability in Simple Terms
Youtube Embed Plus versions up to 14.2.4 lack proper authorization checks, allowing authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data intended for other users or administrators. The vulnerability requires valid site credentials but no additional user interaction.
What an attacker can do
Read sensitive data or information belonging to other users or administrators.
Potential impact on your site
Users' private data may be exposed to other authenticated users with lower privileges.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
