PT-2023-23292 · WordPress · Tutor Lms

A. S. M. Muhiminul Hasan · Publicado 2023-07-04 · Atualizado 2023-07-11 · CVE-2023-3133

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS WordPress plugin versions prior to 2.2.1

Description The issue concerns inadequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API endpoints until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-3133

Produtos afetados

Tutor Lms

Referências · 7

• 🔥 https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 · Exploit
• https://osv.dev/vulnerability/CVE-2023-3133 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-3133 · Nota de Segurança
• https://t.me/cvenotify/54067 · Publicação no Telegram
• https://wordpress.org/plugins/tutor · Nota
• https://t.me/cvenotify/53629 · Publicação no Telegram