PT-2022-14565 · WordPress · Sensei Lms

Veshraj Ghimire · Published 2022-08-29 · Updated 2023-07-04 · CVE-2022-2034

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sensei LMS WordPress plugin versions prior to 4.5.0

Description The issue allows unauthenticated users to access private messages sent to teachers due to improper permissions set in one of its REST endpoints.

Recommendations For versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST endpoint until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-2034

Affected Products

Sensei Lms

References · 5

• 🔥 https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426 · Exploit
• 🔥 https://hackerone.com/reports/1590237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2034 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2034 · Vendor Advisory
• https://t.me/cibsecurity/49001 · Telegram Post