6.5

CVE-2024-1295

Exploit

The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access

The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access

The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)
Mögliche Gegenmaßnahme
The Events Calendar Pro: Update to version 6.4.0.1, or a newer patched version
The Events Calendar: Update to version 6.4.0.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tri ≫ The Events Calendar SwPlatformwordpress Version < 6.4.0.1
Tri ≫ The Events Calendar Editionpro SwPlatformwordpress Version < 6.4.0.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt The Events Calendar Pro
Version *-6.4.0
SystemWordPress Plugin
≫
Produkt The Events Calendar
Version *-6.4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.365
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/3cffbeb0-545a-4002-b02c-0fa38cada1db/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/974c0e94-8d09-488a-9a09-49f0b9ce112c
Third Party Advisory