Description

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).

Remediation

References

CVE-2018-15833

Related Vulnerabilities

MediaWiki Improper Access Control Vulnerability (CVE-2012-4379)

Apache HTTP Server CVE-2016-8743 Vulnerability (CVE-2016-8743)

WordPress CVE-2023-39999 Vulnerability (CVE-2023-39999)

WordPress Plugin WordPress Popups for Marketing and Email Newsletters, Lead Generation and Conversions by OptinMonster Security Bypass (2.6.4)

WordPress Plugin Classified Listing Store & Membership Cross-Site Scripting (1.4.19)

Severity

Medium

Classification

CVE-2018-15833 CWE-639 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities