CVE-2022-0384 Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure

2022-03-0708:16:29

CWE-200

WPScan

www.cve.org

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog

CNA Affected

[
  {
    "product": "Video Conferencing with Zoom",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.8.17",
        "status": "affected",
        "version": "3.8.17",
        "versionType": "custom"
      }
    ]
  }
]