CVE-2024-4279

2024-05-1606:15:10

[email protected]

web.nvd.nist.gov

tutor lms

wordpress

insecure direct object reference

arbitrary course deletion

validation

user controlled key

authenticated attack

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.2%

JSON

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the ‘tutor_course_delete’ function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.

Affected configurations

Vulners

Node

themeumtutor_lmsRange≤2.7.0

VendorProductVersionCPE
themeumtutor_lms*cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
themeum	tutor_lms	*	cpe:2.3:a:themeum:tutor_lms::::::::

CNA Affected

[
  {
    "vendor": "themeum",
    "product": "Tutor LMS – eLearning and online course solution",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]