Vulnerabilities > CVE-2024-8350 - Missing Authorization vulnerability in Uncannyowl Uncanny Groups for Learndash

CVSS 2.7 - LOW

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

uncannyowl

CWE-862

NVD

Published: 2024-09-25

Updated: 2024-10-02

Summary

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site.

Vulnerable Configurations

Part	Description	Count
Application	Uncannyowl Uncannyowl Uncanny Groups FOR Learndash - Uncannyowl Uncanny Groups FOR Learndash 4.0 Uncannyowl Uncanny Groups FOR Learndash 4.0.1 Uncannyowl Uncanny Groups FOR Learndash 4.0.2 Uncannyowl Uncanny Groups FOR Learndash 4.0.3 Uncannyowl Uncanny Groups FOR Learndash 4.0.4 Uncannyowl Uncanny Groups FOR Learndash 4.0.5 Uncannyowl Uncanny Groups FOR Learndash 4.1 Uncannyowl Uncanny Groups FOR Learndash 4.1.1 Uncannyowl Uncanny Groups FOR Learndash 4.2 Uncannyowl Uncanny Groups FOR Learndash 4.2.1 Uncannyowl Uncanny Groups FOR Learndash 4.2.2 Uncannyowl Uncanny Groups FOR Learndash 4.2.3 Uncannyowl Uncanny Groups FOR Learndash 4.3 Uncannyowl Uncanny Groups FOR Learndash 4.4 Uncannyowl Uncanny Groups FOR Learndash 4.4.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.0 Uncannyowl Uncanny Groups FOR Learndash 5.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.1 Uncannyowl Uncanny Groups FOR Learndash 5.2 Uncannyowl Uncanny Groups FOR Learndash 5.2.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.2.0.2 Uncannyowl Uncanny Groups FOR Learndash 5.3 Uncannyowl Uncanny Groups FOR Learndash 5.4 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.1 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.2 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.3 Uncannyowl Uncanny Groups FOR Learndash 5.4.0.4 Uncannyowl Uncanny Groups FOR Learndash 6.0 Uncannyowl Uncanny Groups FOR Learndash 6.0.0.1 Uncannyowl Uncanny Groups FOR Learndash 6.0.1 Uncannyowl Uncanny Groups FOR Learndash 6.0.2 Uncannyowl Uncanny Groups FOR Learndash 6.0.3 Uncannyowl Uncanny Groups FOR Learndash 6.0.4 Uncannyowl Uncanny Groups FOR Learndash 6.1 Uncannyowl Uncanny Groups FOR Learndash 6.1.0.1	36

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References