Vulnerabilites related to automattic - sensei_lms
Vulnerability from fkie_nvd
Published
2022-08-29 18:15
Modified
2024-11-21 07:00
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student
References
contact@wpscan.comhttps://hackerone.com/reports/1592596Exploit, Third Party Advisory
contact@wpscan.comhttps://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/1592596Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5Third Party Advisory
Impacted products
Vendor Product Version
automattic sensei_lms *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "FA276A27-32AE-41E5-8C6F-1D142A0873CA",
                     versionEndExcluding: "4.5.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student",
      },
      {
         lang: "es",
         value: "El plugin Sensei LMS de WordPress versiones anteriores a 4.5.2, no asegura que el remitente de un mensaje privado sea el profesor o el remitente original, permitiendo que cualquier usuario autenticado envíe mensajes a una conversación privada arbitraria por medio de un ataque IDOR. Nota: Los atacantes no pueden visualizar las respuestas/mensajes entre el profesor y el alumno",
      },
   ],
   id: "CVE-2022-2080",
   lastModified: "2024-11-21T07:00:17.150",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-08-29T18:15:09.093",
   references: [
      {
         source: "contact@wpscan.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://hackerone.com/reports/1592596",
      },
      {
         source: "contact@wpscan.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://hackerone.com/reports/1592596",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
      },
   ],
   sourceIdentifier: "contact@wpscan.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-639",
            },
         ],
         source: "contact@wpscan.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-02-12 07:15
Modified
2024-11-21 08:37
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.
References
audit@patchstack.comhttps://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cveThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cveThird Party Advisory
Impacted products
Vendor Product Version
automattic sensei_lms *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "A05BC313-8908-44C5-81C9-593D890E0890",
                     versionEndIncluding: "4.17.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.\n\n",
      },
      {
         lang: "es",
         value: "La neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en Automattic Sensei LMS – Online Courses, Quizzes, & Learning permite almacenar XSS. Este problema afecta a Sensei LMS – Online Courses, Quizzes, & Learning: desde n/ a hasta 4.17.0.",
      },
   ],
   id: "CVE-2023-50875",
   lastModified: "2024-11-21T08:37:27.593",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 3.7,
            source: "audit@patchstack.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-02-12T07:15:08.920",
   references: [
      {
         source: "audit@patchstack.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
      },
   ],
   sourceIdentifier: "audit@patchstack.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "audit@patchstack.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2022-08-29 18:15
Modified
2024-11-21 07:00
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
References
contact@wpscan.comhttps://hackerone.com/reports/1590237Exploit, Third Party Advisory
contact@wpscan.comhttps://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/1590237Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426Exploit, Third Party Advisory
Impacted products
Vendor Product Version
automattic sensei_lms *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "E1F3501C-5404-4AE7-B1BB-D2FA14F42BC2",
                     versionEndExcluding: "4.5.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers",
      },
      {
         lang: "es",
         value: "El plugin Sensei LMS de WordPress versiones anteriores a 4.5.0, no presenta los permisos apropiados establecidos en uno de sus endpoints REST, lo que permite a usuarios no autenticados acceder a los mensajes privados enviados a los profesores",
      },
   ],
   id: "CVE-2022-2034",
   lastModified: "2024-11-21T07:00:12.570",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-08-29T18:15:09.027",
   references: [
      {
         source: "contact@wpscan.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://hackerone.com/reports/1590237",
      },
      {
         source: "contact@wpscan.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://hackerone.com/reports/1590237",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426",
      },
   ],
   sourceIdentifier: "contact@wpscan.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-639",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-09-04 06:15
Modified
2024-10-07 17:46
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
References
contact@wpscan.comhttps://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/Exploit, Third Party Advisory
Impacted products
Vendor Product Version
automattic sensei_lms *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "55CD48D0-8DC7-4E8A-9814-8701438B328E",
                     versionEndExcluding: "4.24.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Sensei LMS  WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.",
      },
      {
         lang: "es",
         value: "El complemento Sensei LMS para WordPress anterior a la versión 4.24.2 no protege adecuadamente algunas de sus rutas de API REST, lo que permite que atacantes no autenticados filtren plantillas de correo electrónico.",
      },
   ],
   id: "CVE-2024-7786",
   lastModified: "2024-10-07T17:46:08.943",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2024-09-04T06:15:17.600",
   references: [
      {
         source: "contact@wpscan.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/",
      },
   ],
   sourceIdentifier: "contact@wpscan.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2022-2034
Vulnerability from cvelistv5
Published
2022-08-29 14:40
Modified
2024-08-03 00:24
Severity ?
Summary
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
References
https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426exploit, vdb-entry, technical-description
https://hackerone.com/reports/1590237
Impacted products
Vendor Product Version
Unknown Sensei LMS Version: 0   < 4.5.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T00:24:43.797Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "exploit",
                     "vdb-entry",
                     "technical-description",
                     "x_transferred",
                  ],
                  url: "https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1590237",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://wordpress.org/plugins",
               defaultStatus: "unaffected",
               product: "Sensei LMS",
               vendor: "Unknown",
               versions: [
                  {
                     lessThan: "4.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Veshraj Ghimire",
            },
            {
               lang: "en",
               type: "coordinator",
               value: "WPScan",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-639 Authorization Bypass Through User-Controlled Key",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-04T08:29:52.463Z",
            orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            shortName: "WPScan",
         },
         references: [
            {
               tags: [
                  "exploit",
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426",
            },
            {
               url: "https://hackerone.com/reports/1590237",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API",
         x_generator: {
            engine: "WPScan CVE Generator",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
      assignerShortName: "WPScan",
      cveId: "CVE-2022-2034",
      datePublished: "2022-08-29T14:40:26",
      dateReserved: "2022-06-08T00:00:00",
      dateUpdated: "2024-08-03T00:24:43.797Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-50875
Vulnerability from cvelistv5
Published
2024-02-12 06:50
Modified
2024-08-02 22:23
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.
References
https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cvevdb-entry
Impacted products
Vendor Product Version
Automattic Sensei LMS – Online Courses, Quizzes, & Learning Version: n/a   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-50875",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-02-16T20:06:02.044041Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:18:05.316Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T22:23:43.911Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://wordpress.org/plugins",
               defaultStatus: "unaffected",
               packageName: "sensei-lms",
               product: "Sensei LMS – Online Courses, Quizzes, & Learning",
               vendor: "Automattic",
               versions: [
                  {
                     changes: [
                        {
                           at: "4.18.0",
                           status: "unaffected",
                        },
                     ],
                     lessThanOrEqual: "4.17.0",
                     status: "affected",
                     version: "n/a",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "Rafie Muhammad (Patchstack)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, &amp; Learning allows Stored XSS.<p>This issue affects Sensei LMS – Online Courses, Quizzes, &amp; Learning: from n/a through 4.17.0.</p>",
                  },
               ],
               value: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.\n\n",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-592",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-592 Stored XSS",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-12T06:50:03.646Z",
            orgId: "21595511-bba5-4825-b968-b78d1f9984a3",
            shortName: "Patchstack",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
               ],
               url: "https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Update to&nbsp;4.18.0 or a higher version.",
                  },
               ],
               value: "Update to 4.18.0 or a higher version.",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "21595511-bba5-4825-b968-b78d1f9984a3",
      assignerShortName: "Patchstack",
      cveId: "CVE-2023-50875",
      datePublished: "2024-02-12T06:50:03.646Z",
      dateReserved: "2023-12-15T14:42:48.487Z",
      dateUpdated: "2024-08-02T22:23:43.911Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-7786
Vulnerability from cvelistv5
Published
2024-09-04 06:00
Modified
2024-09-04 14:17
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
References
https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/exploit, vdb-entry, technical-description
Impacted products
Vendor Product Version
Unknown Sensei LMS Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "sensei_lms",
                  vendor: "automattic",
                  versions: [
                     {
                        lessThan: "4.24.2",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-7786",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-04T14:16:06.300640Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-04T14:17:10.670Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Sensei LMS",
               vendor: "Unknown",
               versions: [
                  {
                     lessThan: "4.24.2",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Sushmita Poudel",
            },
            {
               lang: "en",
               type: "coordinator",
               value: "WPScan",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Sensei LMS  WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-200 Information Exposure",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-09-04T06:00:04.429Z",
            orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            shortName: "WPScan",
         },
         references: [
            {
               tags: [
                  "exploit",
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak",
         x_generator: {
            engine: "WPScan CVE Generator",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
      assignerShortName: "WPScan",
      cveId: "CVE-2024-7786",
      datePublished: "2024-09-04T06:00:04.429Z",
      dateReserved: "2024-08-14T08:29:31.987Z",
      dateUpdated: "2024-09-04T14:17:10.670Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-2080
Vulnerability from cvelistv5
Published
2022-08-29 14:40
Modified
2024-08-03 00:24
Severity ?
Summary
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student
References
https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5x_refsource_MISC
https://hackerone.com/reports/1592596x_refsource_MISC
Impacted products
Vendor Product Version
Unknown Sensei LMS – Online Courses, Quizzes, & Learning Version: 4.5.2   < 4.5.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T00:24:44.176Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1592596",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Sensei LMS – Online Courses, Quizzes, & Learning",
               vendor: "Unknown",
               versions: [
                  {
                     lessThan: "4.5.2",
                     status: "affected",
                     version: "4.5.2",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Veshraj Ghimire",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-639",
                     description: "CWE-639 Authorization Bypass Through User-Controlled Key",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-29T14:40:27",
            orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            shortName: "WPScan",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://hackerone.com/reports/1592596",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR",
         x_generator: "WPScan CVE Generator",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "contact@wpscan.com",
               ID: "CVE-2022-2080",
               STATE: "PUBLIC",
               TITLE: "Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Sensei LMS – Online Courses, Quizzes, & Learning",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_name: "4.5.2",
                                          version_value: "4.5.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Unknown",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "Veshraj Ghimire",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student",
                  },
               ],
            },
            generator: "WPScan CVE Generator",
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-639 Authorization Bypass Through User-Controlled Key",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
                     refsource: "MISC",
                     url: "https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5",
                  },
                  {
                     name: "https://hackerone.com/reports/1592596",
                     refsource: "MISC",
                     url: "https://hackerone.com/reports/1592596",
                  },
               ],
            },
            source: {
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
      assignerShortName: "WPScan",
      cveId: "CVE-2022-2080",
      datePublished: "2022-08-29T14:40:27",
      dateReserved: "2022-06-14T00:00:00",
      dateUpdated: "2024-08-03T00:24:44.176Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}