CVE-2023-3133

CWE-639 — Insecure Direct Object Reference3 documents3 sources
Severity
7.5HIGH
EPSS
1.3%
top 20.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Tutor LMSThemeum Tutor LMS
Timeline
PublishedJul 4

Description

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5unknown/tutor_lms< 2.2.1
▶NVDthemeum/tutor_lms< 2.2.1

🔴Vulnerability Details

2
CVEList
Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API↗2023-07-04
▶
GHSA
GHSA-6qxc-jv43-6qg3: The Tutor LMS WordPress plugin before 2↗2023-07-04
▶
CVE-2023-3133 (HIGH CVSS 7.5) | The Tutor LMS WordPress plugin befo | cvebase.io