Popup Builder generates newsletter unsubscribe tokens as an MD5 of the subscriber ID and e-mail address, a value an attacker can reproduce. An unauthenticated attacker who knows a subscriber’s e-mail address can brute-force the sequential subscriber ID to forge a valid unsubscribe link and remove that person from the site’s mailing list without their consent.

This vulnerability affects the following application versions:

  • Popup Builder by Forward Looking 4.1.15
  • Popup Builder by Forward Looking 4.2.0
  • Popup Builder by Forward Looking 4.2.2
  • Popup Builder by Forward Looking 4.2.3
  • Popup Builder by Forward Looking 4.2.4
  • Popup Builder by Forward Looking 4.2.5
  • Popup Builder by Forward Looking 4.2.6
  • Popup Builder by Forward Looking 4.2.7
  • Popup Builder by Forward Looking 4.3.0
  • Popup Builder by Forward Looking 4.3.2
  • Popup Builder by Forward Looking 4.3.3
  • Popup Builder by Forward Looking 4.3.4
  • Popup Builder by Forward Looking 4.3.5
  • Popup Builder by Forward Looking 4.3.6
  • Popup Builder by Forward Looking 4.3.7
  • Popup Builder by Forward Looking 4.3.8
  • Popup Builder by Forward Looking 4.3.9
  • Popup Builder by Forward Looking 4.4.0
  • Popup Builder by Forward Looking 4.4.1
  • Popup Builder by Forward Looking 4.4.2

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *