CVE-2022-2034
Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
MEDIUM 5.3EPSS 2.5%
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
- Affected
- Sensei LMS
- CVSS v3.1 NVD
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- 2.53% chance of exploitation in the next 30 days, 85th percentile
- Nuclei
- medium · CWE-639
- Published
- 2022-08-29
- Updated
- 2024-08-03