CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
What the vulnerability does
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
Explanation of Vulnerability in Simple Terms
The Gridbox extension for Joomla contains an access control flaw that allows unauthenticated attackers to read, modify, or delete sensitive data and disrupt site operations. No user interaction is required. The vulnerability affects versions 1.0.0 through 2.20.1. Site administrators should update immediately when a patched version becomes available.
What an attacker can do
Read, modify, or delete site data and disrupt operations without authentication.
Potential impact on your site
Attackers can access and alter your site's data and functionality without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
