CVE-2023-3133
Assigner: WPScan
Published: 2023-07-04T07:23:24.882Z
State: PUBLISHED
title: Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API
problemTypes: descriptions: description: CWE-639 Authorization Bypass Through User-Controlled Key
type: CWE
affected: vendor: Unknown
product: Tutor LMS
versions: status: affected
versionType: custom
version: 0
lessThan: 2.2.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
credits: value: A. S. M. Muhiminul Hasan
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator