7.5

CVE-2023-3133

Exploit

Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

Tutor LMS <= 2.2.0 - Missing Authorization via REST API

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Mögliche Gegenmaßnahme
Tutor LMS – eLearning and online course solution: Update to version 2.2.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Themeum ≫ Tutor Lms SwPlatformwordpress Version < 2.2.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Tutor LMS – eLearning and online course solution
Version *-2.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.98% 0.578
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
Product
https://wordpress.org/plugins/tutor/
Product
https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6c9765-6936-4b22-835e-e899f62c14c9
Third Party Advisory