PT-2023-24346 · Masteriyo · The Lms By Masteriyo

Yassir Sbai Fahim · Publicado 2023-07-31 · Atualizado 2024-08-30 · CVE-2023-3345

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The LMS by Masteriyo WordPress plugin versions prior to 1.6.8

Description The issue concerns improper authorization in some of the plugin's REST API endpoints. This allows any students to retrieve email addresses of other students, effectively leaking sensitive user information.

Recommendations For versions prior to 1.6.8, update to version 1.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST API endpoints until a patch is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-3345

Produtos afetados

The Lms By Masteriyo

Referências · 5

• 🔥 https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a · Exploit
• https://t.me/cibsecurity/67439 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3345 · Aviso do Fabricante
• https://t.me/cvenotify/92788 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3345 · Nota de Segurança