CVE-2022-2034

Medium

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated…

WPScan·CWE-639·Published 2022-08-29

CVSS

5.3

EPSS

0.02

KEV

Exploits

cve.orgen

185 chars

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

NVDen

185 chars

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

NVDes

242 chars

El plugin Sensei LMS de WordPress versiones anteriores a 4.5.0, no presenta los permisos apropiados establecidos en uno de sus endpoints REST, lo que permite a usuarios no autenticados acceder a los mensajes privados enviados a los profesores

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N