CVE-2024-0237
Assigner: WPScan
Published: 2024-01-16T15:56:59.963Z
State: PUBLISHED
title: EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update
problemTypes: descriptions: description: CWE-862 Missing Authorization
type: CWE
affected: vendor: Unknown
product: EventON Premium
versions: status: affected
versionType: semver
version: 0
lessThan: 4.5.8
defaultStatus: affected
vendor: Unknown
product: EventON
versions: status: affected
versionType: semver
version: 0
lessThan: 2.2.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
credits: value: Erwan LR (WPScan)
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator