CVE-2024-0237: EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update
Published Jan 16, 2024
·Updated
The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
Affected Software
2 affected components
Myeventon Eventon Wordpress<2.2.7
Myeventon Eventon Wordpress>=4.0<4.5.5
Event History
Jan 16, 2024
CVE Published
via MITRE·03:56 PM
Data Sourced
via MITRE·03:56 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-0237?
CVE-2024-0237 has a moderate severity level due to unauthorized access to sensitive event settings.
2
How do I fix CVE-2024-0237?
To fix CVE-2024-0237, update the EventON WordPress plugin to version 2.2.7 or later.
3
What versions are affected by CVE-2024-0237?
CVE-2024-0237 affects EventON versions prior to 2.2.7 and versions 4.5.5 and below.
4
What actions can unauthenticated users perform due to CVE-2024-0237?
Unauthenticated users can update virtual events settings, including meeting URL and access details due to CVE-2024-0237.
5
Who is the vendor associated with CVE-2024-0237?
The vendor associated with CVE-2024-0237 is Ashan Jay, the developer of the EventON WordPress plugin.