Permissions, Privileges, and Access Controls in NextScripts: Social Networks Auto-Poster - #VU46299
Published: September 7, 2020
Vulnerability identifier: #VU46299
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: NextScripts
Affected software:
NextScripts: Social Networks Auto-Poster
NextScripts: Social Networks Auto-Poster
Detailed vulnerability description
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A remote authenticated attacker can remove posts (by corrupting the post type and other data), post arbitrary information in the site social networks and change the plugin settings.
Remediation
Install updates from vendor's website.