PT-2023-4277 · WordPress · Eventon

Miguel Santareno · Published 2023-07-10 · Updated 2023-08-06 · CVE-2023-2796

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EventON WordPress plugin versions prior to 2.1.2

Description The issue is related to a lack of authentication and authorization in the eventon ics download ajax action of the EventON WordPress plugin. This allows unauthenticated visitors to access private and password-protected events by guessing their numeric id. The vulnerability can be exploited remotely, potentially leading to unauthorized access to protected information.

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the eventon ics download ajax action until a patch is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-04595

CVE-2023-2796

Affected Products

Eventon

References · 11

• 🔥 https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d · Exploit
• 🔥 https://exploit-db.com/exploits/51658 · Exploit
• https://bdu.fstec.ru/vul/2023-04595 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2796 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2796 · Vendor Advisory
• https://github.com/projectdiscovery/nuclei-templates/issues/7663 · Note
• https://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html · Note
• http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html · Note
• https://t.me/cibsecurity/66257 · Telegram Post
• https://t.me/cybersecuritytechnologies/8800 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/eventon-lite/eventon-21-missing-authorization-to-event-access · Note