Vulnerability Name:

CVE-2022-2080 (CCN-234783)

Assigned:2022-08-04
Published:2022-08-04
Updated:2022-09-01
Summary:The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack.
Note: Attackers are not able to see responses/messages between the teacher and student
CVSS v3 Severity:4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.9 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-639
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2022-2080

Source: XF
Type: UNKNOWN
senseilms-cve20222080-sec-bypass(234783)

Source: MISC
Type: Exploit, Third Party Advisory
https://hackerone.com/reports/1592596

Source: CCN
Type: WordPress Plugin Directory
Sensei LMS - Online Courses, Quizzes, & Learning

Source: CCN
Type: WPScan Web site
Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR

Source: MISC
Type: Third Party Advisory
https://wpscan.com/vulnerability/5395d196-a39a-4a58-913e-5b5b9d6123a5

Vulnerable Configuration:Configuration 1:
  • cpe:/a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:* (Version < 4.5.2)

    • Configuration CCN 1:
  • cpe:/a:wordpress:wordpress:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    automattic sensei lms *
    wordpress wordpress -