CVE-2021-24585 Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure
Low-privilege users can retrieve sensitive user data including hashed passwords and emails by exploiting an information disclosure flaw in the plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24585?
CVE-2021-24585 is a medium-severity vulnerability in Unknown Timetable and Event Schedule by MotoPress, published on 20 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
Weakness: CWE-200
Which versions are affected by CVE-2021-24585?
It affects 1 product.
Products include Motopress Timetable and Event Schedule.
How do I fix CVE-2021-24585?
No fix has been published for CVE-2021-24585 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24585 being exploited?
There is no known exploitation of CVE-2021-24585 in the wild and no public exploit code.
Other vulnerabilities in Unknown Timetable and Event Schedule by MotoPress
- CVE-2020-36840 Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
- CVE-2021-24584 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update
- CVE-2021-24724 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting
- CVE-2021-24583 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion
- CVE-2022-2843 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
Sources
Also known as GHSA-xm59-x79v-w7q2.