Description (CNA)
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| getgrav / grav-plugin-star-ratings | affected 2.0.1 before 2.0.4; unaffected 2.0.4 |
CWE
CWE-862
References
- https://github.com/getgrav/grav/security/advisories/GHSA-556j-6jh2-5rcv
- https://www.vulncheck.com/advisories/grav-star-ratings-2.0.1-through-2.0.3-missing-server-side-vote-access-authorization
ADP enrichment
No English description supplied.
No references supplied.