Lucene search
HistoryJul 04, 2023 - 8:15 a.m.
CVE-2023-3133
tutor lms
wordpress
plugin
permission checks
rest api
unauthenticated access
private lesson info
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
42.3%
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Affected configurations
Node
themeumtutor_lmsRange<2.2.1wordpress
Related
wpexploit
wpexploit
prion
prion
Design/Logic Flaw
2023-07-04 08:15:00
cve
cve
CVE-2023-3133
2023-07-04 08:15:10
osv
osv
CVE-2023-3133
2023-07-04 08:15:10
wpvulndb
wpvulndb
cvelist
cvelist
wordfence
wordfence
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
42.3%
Related for NVD:CVE-2023-3133