{"id":"CVE-2023-3345","state":"PUBLISHED","title":"LMS by Masteriyo < 1.6.8 - Information Exposure","description":"The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students","publishedAt":"2023-07-31T09:37:36.423Z","updatedAt":"2024-08-30T13:34:18.185Z","severity":null,"assigner":"WPScan","products":["Unknown LMS by Masteriyo"],"affected":[{"vendor":"Unknown","product":"LMS by Masteriyo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.6.8","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3345.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3345","state":"PUBLISHED","datePublished":"2023-07-31T09:37:36.423Z","dateUpdated":"2024-08-30T13:34:18.185Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-06-20T19:06:59.169Z"},"containers":{"cna":{"title":"LMS by Masteriyo < 1.6.8 - Information Exposure","descriptions":[{"lang":"en","value":"The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students"}],"affected":[{"vendor":"Unknown","product":"LMS by Masteriyo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.6.8","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-08-30T08:35:57.038Z"},"credits":[{"lang":"en","value":"Yassir Sbai Fahim","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:55:02.693Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-30T13:33:59.743546Z","id":"CVE-2023-3345","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-30T13:34:18.185Z"}}]}}}