Vulnerability · Published Aug 15, 2022 · Assigned by WPScan
CVE-2022-2379Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API
High 7.5
In plain English
A high-severity missing authorization in Easy Student Results from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.5%top 10.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical address, phone number etc
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Easy Student Results | 2.2.8 – through 2.2.8 |
Weakness: CWE-862