CVE-2023-3219

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

7.52%

Published

Jul 10, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBWordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-639

Affected Products (1)

myeventon · eventon (up to 2.1.2)vulnerable

References (4)

http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html

https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd

ExploitThird Party Advisory

http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html

https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs