CVE-2024-1122 in Event Manager, Events Calendar, Events Tickets for WooCommerce Plugin

Résumé

par MITRE • 09/02/2024

The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsable: Wordfence
• Réserver: 31/01/2024
• Divulgation: 09/02/2024
• Modérer: accepté
• Entrée: VDB-253220
• CPE: prêt
• CWE: CWE-862 (confirmé)
• CVSS: 5.3 (NVD)
• EPSS: 0.00471
• KEV: non
• Activités: très faible
• Secteur: Hostingprovider, Telecommunication, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-1122
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-1122
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-1122/