CVE-2024-37093
Published: 02 January 2025
Summary
CVE-2024-37093 is a medium-severity CSRF (CWE-352) vulnerability in Stylemixthemes Masterstudy Lms. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-37093 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Stylemix MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system). This issue affects versions from n/a through 3.2.1, allowing CSRF attacks that enable unauthorized actions.
The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Attackers with network access can exploit it with low complexity and no required privileges, but it necessitates user interaction, such as visiting a malicious site or clicking a crafted link. Exploitation results in low integrity impact, permitting attackers to perform state-changing operations on behalf of authenticated users without their knowledge or consent.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-wordpress-plugin-plugin-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, provide details on the vulnerability specific to MasterStudy LMS WordPress plugin version 3.2.1. Security practitioners should consult these resources for recommended mitigations, such as applying available patches or implementing CSRF protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37049
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly enables exploitation of internet-facing web application for unauthorized state changes.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and correction of the specific CSRF flaw in the MasterStudy LMS plugin through patching.
Protects session authenticity with mechanisms like anti-CSRF tokens to prevent attackers from forging state-changing requests on behalf of authenticated users.
Mandates validation of inputs such as CSRF tokens to ensure requests are legitimate and block exploitation of the vulnerability.