CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.
Explanation of Vulnerability in Simple Terms
Display Eventbrite Events versions 6.5.6 and earlier lack proper access controls, allowing unauthenticated attackers to read sensitive event data over the network. The vulnerability requires no user interaction and affects confidentiality only. Site administrators should update to a version newer than 6.5.6 as soon as available.
What an attacker can do
Read sensitive event information without logging in.
Potential impact on your site
Eventbrite event data may be exposed to anyone who knows the plugin is installed.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
