CVE-2023-3345 - LMS by Masteriyo < 1.6.8 - Information Exposure

Back Back to CVE browser

MEDIUM

LMS by Masteriyo < 1.6.8 - Information Exposure

Published Jul 31, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 1.97%

Description

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students

Affected products

Vendor n/a Product LMS by Masteriyo Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.6.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

LMS by Masteriyo

unaffected

Version	Status	Constraints
0	affected	<1.6.8

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jul 31, 2023

Updated Aug 30, 2024

Reserved Jun 20, 2023

Link CVE-2023-3345

CISA Vulnrichment

Updated Aug 30, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-3345

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-3345