CVE-2022-2379

🗓️ 15 Aug 2022 08:37:23Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 2188 Views🌐 WEB

Easy Student Results WordPress plugin through 2.2.8 lacks REST API authorisatio

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-2379	15 Aug 202211:21	–	attackerkb
Circl	CVE-2022-2379	15 Aug 202214:38	–	circl
CNNVD	WordPress plugin Easy Student Results 跨站脚本漏洞	15 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2379 Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API	15 Aug 202208:37	–	cvelist
Nuclei	WordPress Easy Student Results <=2.2.8 - Improper Authorization	18 Jul 202608:12	–	nuclei
NVD	CVE-2022-2379	15 Aug 202211:21	–	nvd
OSV	CVE-2022-2379	15 Aug 202211:21	–	osv
Patchstack	WordPress Easy Student Results plugin <= 2.2.8 - Sensitive Information Disclosure via REST API vulnerability	19 Jul 202200:00	–	patchstack
Prion	Design/Logic Flaw	15 Aug 202211:21	–	prion
Positive Technologies	PT-2022-16264 · WordPress · Easy Student Results	15 Aug 202200:00	–	ptsecurity

NVD

Vulners

Node

easy_student_results_project easy_student_resultsRange≤2.2.8wordpress

[
  {
    "product": "Easy Student Results",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "2.2.8",
        "status": "affected",
        "version": "2.2.8",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/0773ba24-212e-41d5-9ae0-1416ea2c9db6

Parameter	Position	Path	Description	CWE
exam_record_id	query param	/wp-json/rps_result/v1/route/show_result?exam_record_id=2&student_id=32	Unauthenticated access to student results via REST API could disclose grades and PII.	CWE-862
student_id	query param	/wp-json/rps_result/v1/route/show_result?exam_record_id=2&student_id=32	Unauthenticated access to student results via REST API could disclose grades and PII.	CWE-862
department_id	query param	/wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1&semester_id=1	Unauthenticated search of student records based on department, batch and semester.	CWE-862
batch_id	query param	/wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1&semester_id=1	Unauthenticated search of student records based on department, batch and semester.	CWE-862
semester_id	query param	/wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1&semester_id=1	Unauthenticated search of student records based on department, batch and semester.	CWE-862
exam_id	query param	/wp-json/rps_result/v1/route/list_results?exam_id=1&department_id=1&batch_id=1	List results without requiring authentication, potentially exposing student grades.	CWE-862
department_id	query param	/wp-json/rps_result/v1/route/list_results?exam_id=1&department_id=1&batch_id=1	List results without requiring authentication, potentially exposing student grades.	CWE-862
batch_id	query param	/wp-json/rps_result/v1/route/list_results?exam_id=1&department_id=1&batch_id=1	List results without requiring authentication, potentially exposing student grades.	CWE-862