PT-2022-16264 · WordPress · Easy Student Results

Raad Haddad · Published 2022-08-15 · Updated 2022-08-16 · CVE-2022-2379

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy Student Results WordPress plugin versions 2.2.8 and earlier

Description The issue concerns a lack of authorization in the REST API of the Easy Student Results WordPress plugin. This allows unauthenticated users to retrieve sensitive information, including data related to courses, exams, departments, student grades, and personally identifiable information (PII) such as email addresses, physical addresses, and phone numbers.

Recommendations For Easy Student Results WordPress plugin versions 2.2.8 and earlier, consider disabling the REST API until a patch is available to prevent unauthorized access to sensitive information. Restrict access to the plugin's API endpoints to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-2379

Affected Products

Easy Student Results

References · 4

• 🔥 https://wpscan.com/vulnerability/0773ba24-212e-41d5-9ae0-1416ea2c9db6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2379 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2379 · Vendor Advisory
• https://t.me/cibsecurity/48145 · Telegram Post