Lucene search
PRIOn knowledge basePRION:CVE-2022-3891HistoryFeb 13, 2023 - 3:15 p.m.
Design/Logic Flaw
2023-02-1315:15:00
PRIOn knowledge base
www.prio-n.com
5
wp fullcalendar
logic flaw
wordpress plugin
ajax action
unauthenticated attackers
arbitrary posts
draft
private
password-protected
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp_fullcalendar | lt | 1.5 |
Related
wpvulndb
wpvulndb
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-01-17 00:00:00
wpexploit
wpexploit
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-01-17 00:00:00
cvelist
cvelist
CVE-2022-3891 WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-02-13 14:32:26
cve
cve
CVE-2022-3891
2023-02-13 15:15:14
nvd
nvd
CVE-2022-3891
2023-02-13 15:15:14