CVE-2021-34638CWE-22CWE-540CWE-79

WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal

Medium · published August 5, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01331 · 70.9th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-540 · Inclusion of Sensitive Information in Source Code; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-05T20:18Z
EPSS history
Timeline
  • 05 AUG 20:18Z
    WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal
    cvelistv5