4.3
CVE-2022-2080
- EPSS 0.24%
- Veröffentlicht 29.08.2022 18:15:09
- Zuletzt bearbeitet 21.11.2024 07:00:17
- Quelle contact@wpscan.com
- Teams Watchlist Login
- Unerledigt Login
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Automattic ≫ Sensei Lms SwPlatformwordpress Version < 4.5.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.465 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.