CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..
Explanation of Vulnerability in Simple Terms
SP Page Builder for Joomla contains an access control flaw that allows unauthenticated attackers to perform unauthorized actions via the network. The vulnerability requires user interaction and affects confidentiality, integrity, and availability of the site. Update to a version newer than 1.0.0-6.6.2 when available.
What an attacker can do
Perform unauthorized actions on the site without authentication, potentially affecting data confidentiality and integrity.
Potential impact on your site
Unauthorized users can access or modify site content and functionality through SP Page Builder without logging in.
Conditions required to exploit
Network access and user interaction (victim must click a link or visit a page).
Key dates
External resources
Related vulnerabilities
