CVE-2023-3133

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3133

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

T

he Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

References
Link Resource
https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 Product
https://wordpress.org/plugins/tutor/ Product
https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 Exploit Third Party Advisory
https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 Product
https://wordpress.org/plugins/tutor/ Product
https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 08:16

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 - Product () https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 - Product
References () https://wordpress.org/plugins/tutor/ - Product () https://wordpress.org/plugins/tutor/ - Product
References () https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 - Exploit, Third Party Advisory () https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 - Exploit, Third Party Advisory
Information

Published : 2023-07-04 08:15

Updated : 2024-11-21 08:16

NVD link : CVE-2023-3133

Mitre link : CVE-2023-3133

CVE.ORG link : CVE-2023-3133

JSON object : View

Products Affected

themeum

CWE

No CWE.