CVE-2022-28986
Last modified
CVE-2022-28986 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.. EPSS estimates a 2.87% chance of exploitation in the next 30 days.
Description
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lmsdoctor | 2 Factor Authentication | 2021072900 |
References
- https://github.com/FlaviuPopescu/CVE-2022-28986Exploit, Third Party Advisory
- https://github.com/FlaviuPopescu/CVE-2022-28986Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-28986?
How severe is CVE-2022-28986?
How do I fix CVE-2022-28986?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28979Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 bef…6.1
- CVE-2022-2898Measuresoft ScadaPro Server and Client (All Versions) do not…5.5
- CVE-2022-28980Multiple cross-site scripting (XSS) vulnerabilities in Lifer…6.1
- CVE-2022-28981Path traversal vulnerability in the Hypermedia REST APIs mod…7.5
- CVE-2022-28982A cross-site scripting (XSS) vulnerability in Liferay Portal…6.1
- CVE-2022-28985A stored cross-site scripting (XSS) vulnerability in the add…5.4
- CVE-2022-28987Zoho ManageEngine ADSelfService Plus before 6202 allows atta…5.3
- CVE-2022-28990WASM3 v0.5.0 was discovered to contain a heap overflow via t…7.8
- CVE-2022-28991Multi Store Inventory Management System v1.0 was discovered …7.5
- CVE-2022-28992A Cross-Site Request Forgery (CSRF) in Online Banquet Bookin…8.8
- CVE-2022-28993Multi Store Inventory Management System v1.0 allows attacker…9.8
- CVE-2022-28994Small HTTP Server version 3.06 suffers from a remote buffer …9.8
Are you affected by CVE-2022-28986?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST