CVE-2024-0238: medium-severity vulnerability in EventON
EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.4%
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CVEs — EventON
In the same product, most dangerous first.
CVE-2023-2796—EventON < 2.1.2 - Unauthenticated Event AccessEPSS 42.7%CVE-2024-0235MEDIUMEventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address DisclosureEPSS 38.0%CVE-2023-3219—EventON < 2.1.2 - Unauthenticated Post Access via IDOREPSS 7.5%CVE-2023-4388MEDIUMEventON < 2.2 - Admin+ Stored XSSEPSS 0.5%CVE-2024-0236MEDIUMEventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password DisclosureEPSS 0.5%CVE-2023-6005MEDIUMEventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site ScriptingEPSS 0.4%