PT-2024-12208 · WordPress · Tutor Lms

Ram + 1 · Published 2024-09-10 · Updated 2024-09-26 · CVE-2023-2919

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS plugin for WordPress versions up to, and including, 2.7.4

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addon enable disable function. This allows unauthenticated attackers to enable or disable addons via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For versions up to, and including, 2.7.4, consider disabling the addon enable disable function until a patch is available to prevent exploitation. Restrict access to the addon management interface to minimize the risk of unauthorized changes. Update to a version that includes the fix for this issue once it becomes available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-2919

Affected Products

Tutor Lms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-2919 · Security Note
• https://plugins.trac.wordpress.org/changeset/3148621/tutor/tags/2.7.5/classes/Ajax.php · Patch
• https://osv.dev/vulnerability/CVE-2023-2919 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1833492024495907266 · Twitter Post
• https://t.me/cvenotify/96253 · Telegram Post
• https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Ajax.php?rev=3128650#L506 · Note
• https://twitter.com/CVEnew/status/1833443223672426656 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/992abd72-2a8e-4bda-94c2-4a7f88487906?source=cve · Note