by Kastro
Paper/Archive/CVE-2024-4223

CVE-2024-4223

themeum Tutor LMS – eLearning and online course solution — Tutor LMS <= 2.7.0 - Missing Authorization

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.0.440 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.

Affected

ProductAffectedFixed inSource
Tutor LMS – eLearning and online course solution≤ 2.7.0–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cverefplugins.trac.wordpress.org/changeset/3086489