Lucene search

WPScanCVE-2023-6447

HistoryJan 22, 2024 - 8:15 p.m.

CVE-2023-6447

2024-01-2220:15:47

WPScan

web.nvd.nist.gov

cve-2023-6447

eventprime

wordpress plugin

authentication

authorization

unauthenticated access

private events

password protection

security vulnerability

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

17.0%

JSON

The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.

Affected configurations

Nvd

Vulners

Node

metagausseventprimeRange<3.3.6wordpress

VendorProductVersionCPE
metagausseventprime*cpe:2.3:a:metagauss:eventprime:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
metagauss	eventprime	*	cpe:2.3:a:metagauss:eventprime::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "EventPrime",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.3.6"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/e366881c-d21e-4063-a945-95e6b080a373/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-6447