CVE-2022-0384 — Sensitive Information Exposure in Video Conferencing With Zoom

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 46.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Imdpen Video Conferencing With Zoom
Timeline
PublishedMar 7
Latest updateMar 8

Description

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-whpj-8vvw-fc5h: The Video Conferencing with Zoom WordPress plugin before 3↗2022-03-08
▶
CVEList
Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure↗2022-03-07
▶
CVE-2022-0384 — Sensitive Information Exposure | cvebase