Vulnerabilities > CVE-2024-8349 - Missing Authorization vulnerability in Uncannyowl Uncanny Groups for Learndash

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

uncannyowl

CWE-862

NVD

Published: 2024-09-25

Updated: 2024-10-02

Summary

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.

Vulnerable Configurations

Part	Description	Count
Application	Uncannyowl Uncannyowl Uncanny Groups FOR Learndash - Uncannyowl Uncanny Groups FOR Learndash 4.0 Uncannyowl Uncanny Groups FOR Learndash 4.0.1 Uncannyowl Uncanny Groups FOR Learndash 4.0.2 Uncannyowl Uncanny Groups FOR Learndash 4.0.3 Uncannyowl Uncanny Groups FOR Learndash 4.0.4 Uncannyowl Uncanny Groups FOR Learndash 4.0.5 Uncannyowl Uncanny Groups FOR Learndash 4.1 Uncannyowl Uncanny Groups FOR Learndash 4.1.1 Uncannyowl Uncanny Groups FOR Learndash 4.2 Uncannyowl Uncanny Groups FOR Learndash 4.2.1 Uncannyowl Uncanny Groups FOR Learndash 4.2.2 Uncannyowl Uncanny Groups FOR Learndash 4.2.3 Uncannyowl Uncanny Groups FOR Learndash 4.3 Uncannyowl Uncanny Groups FOR Learndash 4.4 Uncannyowl Uncanny Groups FOR Learndash 4.4.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.0 Uncannyowl Uncanny Groups FOR Learndash 5.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.1 Uncannyowl Uncanny Groups FOR Learndash 5.2 Uncannyowl Uncanny Groups FOR Learndash 5.2.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.2.0.2 Uncannyowl Uncanny Groups FOR Learndash 5.3 Uncannyowl Uncanny Groups FOR Learndash 5.4 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.2 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.3 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.4 Uncannyowl Uncanny Groups FOR Learndash 6.0 Uncannyowl Uncanny Groups FOR Learndash 6.0.0.1 Uncannyowl Uncanny Groups FOR Learndash 6.0.1 Uncannyowl Uncanny Groups FOR Learndash 6.0.2 Uncannyowl Uncanny Groups FOR Learndash 6.0.3 Uncannyowl Uncanny Groups FOR Learndash 6.0.4 Uncannyowl Uncanny Groups FOR Learndash 6.1 Uncannyowl Uncanny Groups FOR Learndash 6.1.0.1	36

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References