PT-2024-36265 · WordPress · The Tutor Lms

Thanh Nam Tran · Published 2024-06-07 · Updated 2024-06-11 · CVE-2024-5438

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Tutor LMS – eLearning and online course solution plugin for WordPress versions up to, and including, 2.7.1

Description: The issue allows authenticated attackers with Instructor-level access and above to delete arbitrary quiz attempts due to missing validation on a user-controlled key in the attempt delete function. This is possible because of an Insecure Direct Object Reference.

Recommendations: For versions up to, and including, 2.7.1, update to a version that includes a fix for the missing validation in the attempt delete function to prevent arbitrary quiz attempt deletion. As a temporary workaround, consider restricting access to the attempt delete function for users with Instructor-level access and above until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-5438

Affected Products

The Tutor Lms

References · 6

• https://osv.dev/vulnerability/CVE-2024-5438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5438 · Security Note
• https://plugins.trac.wordpress.org/changeset/3098465 · Patch
• https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L1806 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=cve · Note
• https://t.me/cvenotify/82278 · Telegram Post