Improper Access Control in DiveBook Plugin for WordPress
CVE-2020-14205

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Divebook
Vendor
CVE Published:
8 December 2020

Summary

The DiveBook plugin version 1.1.4 for WordPress has a vulnerability due to insufficient authorization checks in the Log Dive form. This weakness can be exploited by an attacker to manipulate dive log data, leading to potential integrity issues in the logs that may affect users' diving records.

References

https://wordpress.org/plugins/divebook/#developers
x_refsource_MISC
https://www.hooperlabs.xyz/disclosures/divebook.php
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.