CVE-2023-2796: EventON < 2.1.2 - Unauthenticated Event Access
Published Jul 10, 2023
·Updated
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventonicsdownload ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
Credit
Miguel Santareno
Affected Software
1 affected component
Myeventon Eventon Wordpress<2.1.2
Event History
Jul 10, 2023
CVE Published
via MITRE·12:40 PM
Data Sourced
via MITRE·12:40 PM
DescriptionWeakness
Aug 4, 2023
Exploit Published
12:00 AM
Known Exploited
12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID for the EventON WordPress plugin vulnerability?
The vulnerability ID for the EventON WordPress plugin vulnerability is CVE-2023-2796.
2
What is the severity of CVE-2023-2796?
The severity of CVE-2023-2796 is medium (5.3).
3
What is the affected software by CVE-2023-2796?
The affected software by CVE-2023-2796 is the EventON WordPress plugin version up to 2.1.2.
4
What is the issue with the EventON WordPress plugin?
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action.
5
How can an attacker exploit CVE-2023-2796?
An attacker can exploit CVE-2023-2796 by guessing the numeric id of private and password protected Events.