CVE-2022-2034

Опубликовано: 29 авг. 2022

Источник: nvd

CVSS3: 5.3

EPSS Средний

Описание

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

Ссылки

https://hackerone.com/reports/1590237
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426
Exploit
Third Party Advisory
https://hackerone.com/reports/1590237
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*

Версия до 4.5.0 (исключая)

EPSS

Процентиль: 97%

0.33749

Средний

5.3 Medium

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-h8qw-944w-6vhw