Описание
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.
EPSS
Процентиль: 16%
0.00241
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 5.3
github
8 дней назад
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.
EPSS
Процентиль: 16%
0.00241
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-200