7.5
CVE-2015-20067
- EPSS 19.12%
- Veröffentlicht 01.11.2021 09:15:08
- Zuletzt bearbeitet 21.11.2024 02:26:33
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWP Attachment Export < 0.2.4 - Arbitrary File Download
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Mögliche Gegenmaßnahme
WP Attachment Export: Update to version 0.2.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Attachment Export
Version
[*, 0.2.4)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wp Attachment Export Project ≫ Wp Attachment Export SwPlatformwordpress Version < 0.2.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 19.12% | 0.951 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.