What is the CVSS score of CVE-2022-0384?

CVE-2022-0384 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 1.0%.

Is there a public PoC exploit available for CVE-2022-0384?

Yes, a public proof-of-concept exploit is available for CVE-2022-0384. Prioritise patching immediately. EPSS: 1.0%.

Is there a patch available for CVE-2022-0384?

Yes, a patch is available for CVE-2022-0384. Update the affected software to the latest version immediately.

Video Conferencing With Zoom CVE-2022-0384

MEDIUM

Information Exposure (CWE-200)

2022-03-07 contact@wpscan.com

WordPress Information Disclosure Video Conferencing With Zoom

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 07, 2022 - 09:15 nvd

MEDIUM 4.3

DescriptionNVD

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog

AnalysisAI

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog Affected products include: Imdpen Video Conferencing With Zoom. Version information: before 3.8.17.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.