CVE-2021-24146 Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

2021-03-1814:57:50

CWE-284

WPScan

www.cve.org

0.026 Low

EPSS

Percentile

90.4%

JSON

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.

CNA Affected

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.16.5",
        "status": "affected",
        "version": "5.16.5",
        "versionType": "custom"
      }
    ]
  }
]