CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
Explanation of Vulnerability in Simple Terms
JEM - Joomla Event Manager contains an authorization bypass vulnerability in how it validates user-controlled keys. An authenticated administrator can manipulate request parameters to bypass access controls and modify data they should not have permission to change. The vulnerability requires high-level privileges to exploit and has limited integrity impact.
What an attacker can do
Modify event data or settings beyond their authorized scope by manipulating request parameters.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can alter event information without proper authorization checks.
Conditions required to exploit
Attacker must have administrator-level access to the Joomla site.
Key dates
External resources
Related vulnerabilities
