Masteriyo LMS <=1.13.3 Authenticated Privilege Escalation via Missing Authorization (CVE-2024-10008)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Masteriyo LMS - eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation 2. Vulnerability Description: - Describes a vulnerability in the Masteriyo LMS plugin for versions <= 1.13.3, where unauthorized user configuration modification is possible. - Due to missing authorization checks in the REST API endpoint, users with student-level privileges can modify configurations of any user. - This allows attackers to escalate their privileges to administrator level and delete existing administrator accounts. 3. Vulnerability Rating: - CVSS Score: 3.1 - CVSS Score: 8.8 (High) 4. Public Release Date: October 28, 2024 5. Last Updated Date: October 29, 2024 6. Researcher: floerer - FloSecurity 7. Vulnerability ID: CVE-2024-10008 8. Affected Versions: <= 1.13.3 9. Fixed Version: 1.13.4 10. Remediation Recommendation: Upgrade to version 1.13.4 or a later patched version. 11. Reference Link: plugins.trac.wordpress.org 12. Vulnerability Details: - Provides detailed information about the vulnerability, including vulnerability type, software type, software version, and remediation status. 13. Copyright Information: - Copyright information from Defiant Inc. and MITRE Corporation. - Includes licensing terms for use and reproduction of this information. 14. Contact Information: - Contact email for Defiant Inc.: wfi-support@wordfence.com. This information helps users understand the severity, scope of impact, and how to remediate and prevent the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Masteriyo LMS <=1.13.3 Authenticated Privilege Escalation via Missing Authorization (CVE-2024-10008)

More from this source