Eric Schayes

The issue is related to a lack of protection against cross-site request forgery (CSRF) attacks in the web-based management interface. An attacker could exploit this by persuading a user to follow a malicious link, potentially allowing the attacker to perform arbitrary actions on the affected system with the privilege level of the affected user.

The issue is related to how specially crafted requests are handled by the Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client, leading to a denial of service vulnerability. This vulnerability is caused by insufficient input validation in the mrxsmb.sys module, which implements the SMBv2/SMBv3 protocol in Windows operating systems. An attacker could exploit this vulnerability by sending a specially crafted packet, allowing them to cause a denial of service in the SMB client.

The issue allows authenticated users to edit documents of other users without proper permissions. This is due to a problem in the includes/component.php file of the BuddyPress Docs plugin for WordPress.