CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
Explanation of Vulnerability in Simple Terms
Nexcess Event Tickets versions 5.28.5 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify event data over the network. The vulnerability does not expose sensitive information or disrupt availability, but attackers can alter event details without permission. Update to a version newer than 5.28.5 to resolve this issue.
What an attacker can do
Modify event ticket data and settings without authentication.
Potential impact on your site
Event data can be altered by anyone on the internet without your knowledge or consent.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
