The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
References
Configurations
History
21 Nov 2024, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html - | |
| References | () https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd - Exploit, Third Party Advisory |
07 Nov 2023, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
04 Aug 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Jul 2023, 17:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Myeventon eventon
Myeventon |
|
| CPE | cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | (MISC) https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd - Exploit, Third Party Advisory |
10 Jul 2023, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-10 16:15
Updated : 2024-11-21 08:16
NVD link : CVE-2023-3219
Mitre link : CVE-2023-3219
CVE.ORG link : CVE-2023-3219
JSON object : View
Products Affected
myeventon
- eventon
CWE
CWE-639
Authorization Bypass Through User-Controlled Key