CVE-2024-0235mediumobserved exploitation

CVE-2024-0235: medium-severity vulnerability in EventON

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

Published · Updated

Follow this CVE+ Monitor EventON

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 38%
from disclosure to weapon380 days
Published on NVDJan 16
1st PoC+380d
VulnCheck+585d
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · EventON
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — EventON

In the same product, most dangerous first.

CVE-2023-2796—EventON < 2.1.2 - Unauthenticated Event AccessEPSS 42.7%CVE-2023-3219—EventON < 2.1.2 - Unauthenticated Post Access via IDOREPSS 7.5%CVE-2023-4388MEDIUMEventON < 2.2 - Admin+ Stored XSSEPSS 0.5%CVE-2024-0236MEDIUMEventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password DisclosureEPSS 0.5%CVE-2023-6005MEDIUMEventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-6046MEDIUMEventON < 2.2 - Admin+ Stored HTML InjectionEPSS 0.4%