Lucene search

WPScanCVE-2023-6421

HistoryJan 01, 2024 - 3:15 p.m.

CVE-2023-6421

2024-01-0115:15:43

CWE-522

WPScan

web.nvd.nist.gov

cve-2023-6421

download manager

wordpress plugin

security vulnerability

file download

password leak

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

36.0%

JSON

The Download Manager WordPress plugin before 3.2.83 does not protect file download’s passwords, leaking it upon receiving an invalid one.

Affected configurations

Nvd

Vulners

Node

wpdownloadmanagerwordpress_download_managerRange<3.2.83wordpress

VendorProductVersionCPE
wpdownloadmanagerwordpress_download_manager*cpe:2.3:a:wpdownloadmanager:wordpress_download_manager:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpdownloadmanager	wordpress_download_manager	*	cpe:2.3:a:wpdownloadmanager:wordpress_download_manager::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Download Manager",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.2.83"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/244c7c00-fc8d-4a73-bbe0-7865c621d410

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

36.0%

JSON

Related for CVE-2023-6421