CVE-2022-2379

The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical address, phone number etc

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

3.39% chance of exploitation in the next 30 days, 88th percentile

Nuclei

high · CWE-862

Published

2022-08-15

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0773ba24-212e-41d5-9ae0-1416ea2c9db6

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2379.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-2378
• CVE-2022-23793
• CVE-2022-23779
• CVE-2022-23803
• CVE-2022-23773
• CVE-2022-23804