CVE-2021-24585

{"id": "CVE-2021-24585", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-09-20T10:15:08.627", "references": [{"url": "https://wpscan.com/vulnerability/cd288a92-903b-47c9-83ac-8e5b677e949b", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id"}, {"lang": "es", "value": "El plugin de Timetable and Event Schedule de WordPress versiones anteriores a 2.4.0, muestra la Contrase\u00f1a Codificada, el Nombre de Usuario y la Direcci\u00f3n de Correo Electr\u00f3nico (junto con otros datos menos confidenciales) del usuario relacionado con el jefe de horario en la respuesta cuando se solicitan los datos del horario del evento con un usuario con la capacidad edit_posts. Combinado con el otro problema de Modificaci\u00f3n de Timeslots de Eventos no Autorizados (https://wpscan.com/reports/submissions/4699/) donde puede ser establecido un ID de usuario arbitrario, esto podr\u00eda permitir a usuarios de bajo privilegio con la capacidad edit_posts (como el autor) recuperar datos confidenciales del usuario al iterar sobre el user_id"}], "lastModified": "2021-10-01T16:29:24.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "888F8B5E-30DD-47B4-80DC-E08564109985", "versionEndExcluding": "2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}