2 lines
2.5 KiB
JSON
2 lines
2.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"Sensei LMS – Online Courses, Quizzes, & Learning","vendor":"Unknown","versions":[{"lessThan":"4.5.2","status":"affected","version":"4.5.2","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"FA276A27-32AE-41E5-8C6F-1D142A0873CA","versionEndExcluding":"4.5.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student"},{"lang":"es","value":"El plugin Sensei LMS de WordPress versiones anteriores a 4.5.2, no asegura que el remitente de un mensaje privado sea el profesor o el remitente original, permitiendo que cualquier usuario autenticado envíe mensajes a una conversación privada arbitraria por medio de un ataque IDOR. Nota: Los atacantes no pueden visualizar las respuestas/mensajes entre el profesor y el alumno"}],"id":"CVE-2022-2080","lastModified":"2026-06-17T04:41:14.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-08-29T18:15:09.093","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/1592596"},{"source":"contact@wpscan.com","tags":["Third Party Advisory"],"url":"https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/1592596"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"contact@wpscan.com","type":"Secondary"}]}
|