CVE-2023-2796

MEDIUMNuclei

EventON < 2.1.2 - Unauthenticated Event Access

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-2796 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 12, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

EventON

Default status: unaffected

CVE ListBefore 2.1.2affected

eventon

Browse myeventon / eventon
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBWordpress Plugin EventON Calendar 4.4 - Unauthenticated Event AccessExploitDB exploitby Miguel SantarenoNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMEventON <= 2.1 - Missing AuthorizationCVSS 5.3

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Impact

Unauthenticated users can perform privileged actions, potentially leading to unauthorized access or modification of events.

Remediation

Fixed in version 2.1.2

WeaknessesCWE-862
Authorsrandomrobbie
Template tagscve2023cvewpscanpacketstormwordpresswp-pluginwpeventonbypassmyeventonvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*
Shodan: vuln:CVE-2023-2796
Shodan: http.html:/wp-content/plugins/eventon-lite/
Shodan: http.html:/wp-content/plugins/eventon/
FOFA: wp-content/plugins/eventon/
FOFA: body=/wp-content/plugins/eventon/
FOFA: body=/wp-content/plugins/eventon-lite/
Google: inurl:"/wp-content/plugins/eventon/"
https://www.wordfence.com/threat-intel/vulnerabilities/id/dba3f3a6-3f55-4f4e-98e4-bb98d9c94bdd https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d https://nvd.nist.gov/vuln/detail/CVE-2023-2796 http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html https://github.com/nullfuzz-pentest/shodan-dorks

Source: ProjectDiscovery

References

3