Lucene search

WordfenceCVE-2024-5784

HistoryAug 30, 2024 - 4:15 a.m.

CVE-2024-5784

2024-08-3004:15:08

CWE-862

Wordfence

web.nvd.nist.gov

cve-2024-5784

tutor lms pro

wordpress

missing authorization

insecure direct object reference

vulnerable plugin

authentication bypass

capability checks

administrative actions

unauthorized access

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

14.1%

JSON

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.

Affected configurations

Nvd

Vulners

Node

tutorlmstutor_lms_proRange<2.7.3wordpress

VendorProductVersionCPE
tutorlmstutor_lms_pro*cpe:2.3:a:tutorlms:tutor_lms_pro:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
tutorlms	tutor_lms_pro	*	cpe:2.3:a:tutorlms:tutor_lms_pro::::::wordpress::*

CNA Affected

[
  {
    "vendor": "themium",
    "product": "Tutor LMS Pro",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.7.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

tutorlms.com/releases/id/299/

www.wordfence.com/threat-intel/vulnerabilities/id/aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8?source=cve

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

14.1%

JSON

Related for CVE-2024-5784