CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Explanation of Vulnerability in Simple Terms
JEM - Joomla Event Manager contains an authorization bypass vulnerability in how it validates user-controlled keys. An authenticated user with low privileges can bypass access controls by manipulating request parameters, potentially gaining unauthorized access to restricted event data or functionality. The vulnerability requires an active Joomla user account but no additional user interaction.
What an attacker can do
Bypass access controls to view or modify event data they should not have permission to access.
Potential impact on your site
Unauthorized users may access or modify event information, compromising event privacy and data integrity.
Conditions required to exploit
Attacker must have a valid Joomla user account with low privileges; no special network access required.
Key dates
External resources
Related vulnerabilities
