CVE-2022-2034: Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
Published Aug 29, 2022
·Updated
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
Affected Software
1 affected component
Automattic Sensei Lms Wordpress<4.5.0
Event History
Aug 29, 2022
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Sensei LMS WordPress plugin vulnerability?
The vulnerability ID for this Sensei LMS WordPress plugin vulnerability is CVE-2022-2034.
2
What is the title of this vulnerability?
The title of this vulnerability is 'The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers'.
3
What is the severity of CVE-2022-2034?
CVE-2022-2034 has a severity of 5.3, which is considered medium.
4
How does CVE-2022-2034 affect the Sensei LMS WordPress plugin?
CVE-2022-2034 affects the Sensei LMS WordPress plugin version up to and excluding 4.5.0.
5
How can I fix CVE-2022-2034 in the Sensei LMS WordPress plugin?
To fix CVE-2022-2034 in the Sensei LMS WordPress plugin, update it to version 4.5.0 or higher.