CVE-2022-2034

🗓️ 29 Aug 2022 14:40:26Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 146 Views🌐 WEB

The Sensei LMS WordPress plugin before 4.5.0 allows unauthenticated access to private message

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-2034	29 Aug 202218:15	–	attackerkb
Circl	CVE-2022-2034	29 Aug 202222:34	–	circl
CNNVD	WordPress plugin Sensei LMS 安全漏洞	29 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2034 Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API	29 Aug 202214:40	–	cvelist
Nuclei	WordPress Sensei LMS <4.5.0 - Information Disclosure	6 Jun 202603:01	–	nuclei
NVD	CVE-2022-2034	29 Aug 202218:15	–	nvd
Patchstack	WordPress Sensei LMS plugin <= 4.4.3 - Unauthenticated Private Messages Disclosure via Rest API vulnerability	4 Aug 202200:00	–	patchstack
Prion	Design/Logic Flaw	29 Aug 202218:15	–	prion
Positive Technologies	PT-2022-14565 · WordPress · Sensei Lms	29 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2034	22 May 202523:35	–	redhatcve

NVD

Vulners

Node

automattic sensei_lmsRange<4.5.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Sensei LMS",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.5.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1590237
wpscan	www.wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426

Parameter	Position	Path	Description	CWE
numericID	path	wp-json/wp/v2/sensei-messages/<numericID>	Unauthenticated access to private messages via Sensei LMS REST endpoint due to improper access control.	CWE-639