CVE-2023-3219: EventON < 2.1.2 - Unauthenticated Post Access via IDOR
The EventON WordPress plugin before 2.1.2 does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3219?
The severity of CVE-2023-3219 is medium with a severity value of 5.3.
How does CVE-2023-3219 affect the EventON WordPress plugin?
CVE-2023-3219 affects the EventON WordPress plugin before version 2.1.2.
What is the vulnerability in CVE-2023-3219?
The vulnerability in CVE-2023-3219 allows unauthenticated visitors to access any Post content, including unpublished or protected posts, via the ics export functionality.
How can I fix CVE-2023-3219?
To fix CVE-2023-3219, update the EventON WordPress plugin to version 2.1.2 or later.
Are there any references for CVE-2023-3219?
Yes, you can find more information about CVE-2023-3219 at the following references: [Link 1](https://www.exploit-db.com/exploits/51659), [Link 2](http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html), [Link 3](https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd)