PT-2024-3145 · Tutor Lms · Tutor Lms

M. Awad + 1 · Published 2024-04-09 · Updated 2025-01-15 · CVE-2024-3553

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to, and including, 2.6.2

Description The issue is related to a missing capability check on the hide notices function, which allows unauthorized modification of data. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled. The vulnerability can be exploited by a remote attacker to gain read and modify access to data.

Recommendations For versions up to, and including, 2.6.2, update to a version higher than 2.6.2 to resolve the issue. As a temporary workaround, consider disabling the hide notices function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-03358

CVE-2024-3553

Affected Products

Tutor Lms

References · 9

• https://osv.dev/vulnerability/CVE-2024-3553 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3076302/tutor/tags/2.7.0/classes/User.php · Patch
• https://bdu.fstec.ru/vul/2024-03358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3553 · Security Note
• https://twitter.com/VulmonFeeds/status/1786124995476787447 · Twitter Post
• https://vuldb.com/ru/?id.262218 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc?source=cve · Note
• https://twitter.com/CVEnew/status/1786082016405913863 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor/tutor-lms-262-missing-authorization-to-unauthenticated-limited-options-update · Note