CVE-2023-4836

Опубликовано: 31 окт. 2023

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced

Ссылки

https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
Exploit
Third Party Advisory
https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:*:*:*:*:*:wordpress:*:*

Версия до 2.0.5 (исключая)

EPSS

Процентиль: 51%

0.00276

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-r75f-cj9v-2727