PT-2023-24346 · Masteriyo · The Lms By Masteriyo

Yassir Sbai Fahim · Published 2023-07-31 · Updated 2024-08-30 · CVE-2023-3345

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The LMS by Masteriyo WordPress plugin versions prior to 1.6.8

Description The issue concerns improper authorization in some of the plugin's REST API endpoints. This allows any students to retrieve email addresses of other students, effectively leaking sensitive user information.

Recommendations For versions prior to 1.6.8, update to version 1.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST API endpoints until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2023-3345

Affected Products

The Lms By Masteriyo

References · 5

• 🔥 https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a · Exploit
• https://osv.dev/vulnerability/CVE-2023-3345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3345 · Security Note
• https://t.me/cibsecurity/67439 · Telegram Post
• https://t.me/cvenotify/92788 · Telegram Post