The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/c62be802-e91a-4bcf-990d-8fd8ef7c9a28 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/c62be802-e91a-4bcf-990d-8fd8ef7c9a28 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 08:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/c62be802-e91a-4bcf-990d-8fd8ef7c9a28 - Exploit, Third Party Advisory |
12 Sep 2024, 13:35
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) El complemento Quiz Maker WordPress anterior a 6.4.9.5 no autoriza adecuadamente la acción AJAX `ays_quiz_author_user_search`, lo que permite que un atacante no autenticado realice una búsqueda de usuarios del sistema y, en última instancia, filtre las direcciones de correo electrónico de los usuarios. |
02 Jan 2024, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ays-pro quiz Maker
Ays-pro |
|
| CPE | cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-287 | |
| References | () https://wpscan.com/vulnerability/c62be802-e91a-4bcf-990d-8fd8ef7c9a28 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| Summary |
|
26 Dec 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-26 19:15
Updated : 2024-11-21 08:43
NVD link : CVE-2023-6155
Mitre link : CVE-2023-6155
CVE.ORG link : CVE-2023-6155
JSON object : View
Products Affected
ays-pro
- quiz_maker
CWE
CWE-287
Improper Authentication