LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
CVE-2021-24562

7.5HIGH

Key Information:

Vendor

Wordpress
Status
Lms By Lifterlms – Online Course, Membership & Learning Management System Plugin For WordPress
Vendor
CVE Published:
23 August 2021

What is CVE-2021-24562?

The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades

Affected Version(s)

LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress 4.21.2

References

https://wpscan.com/vulnerability/d45bb744-4a0d-4af0-aa16-...
x_refsource_MISC
https://make.lifterlms.com/2021/05/17/lifterlms-version-4...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amirmuhammad vakili
.