PT-2024-3145 · Tutor Lms · Tutor Lms

🗓️ 09 Apr 2024 00:00:00Reported by Positive TechnologiesType

Tutor LMS up to 2.6.2 has a missing capability check in hide notices, enabling unauthenticated read and modify access.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Missing Authorization in Themeum Tutor_Lms	26 Dec 202515:22	–	githubexploit
BDU FSTEC	Tutor LMS Plugin Access Disclosure	30 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-3553	26 Dec 202521:00	–	circl
CNNVD	WordPress plugin Tutor LMS has a security vulnerability	2 May 202400:00	–	cnnvd
CVE	CVE-2024-3553	2 May 202416:52	–	cve
Cvelist	CVE-2024-3553 Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update	2 May 202416:52	–	cvelist
EUVD	EUVD-2024-32139	3 Oct 202520:07	–	euvd
Kitploit	CVE-2024-3553	26 Oct 202617:03	–	kitploit
NVD	CVE-2024-3553	2 May 202417:15	–	nvd
osv_cve	CVE-2024-3553	2 May 202417:15	–	osv_cve

Source	Link
bdu	www.bdu.fstec.ru/vul/2024-03358
plugins	www.plugins.trac.wordpress.org/changeset/3076302/tutor/tags/2.7.0/classes/User.php
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3553
osv	www.osv.dev/vulnerability/CVE-2024-3553
twitter	www.twitter.com/VulmonFeeds/status/1786124995476787447
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor/tutor-lms-262-missing-authorization-to-unauthenticated-limited-options-update
twitter	www.twitter.com/CVEnew/status/1786082016405913863
vuldb	www.vuldb.com/ru/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

15 Jan 2025 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.16.5

EPSS0.00462

SSVC