CVE-2022-2926CWE-22

Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal

Medium · published September 26, 2022

CVSS v3.1
4.9
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01706 · 77.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-09-26T12:35Z
EPSS history
Timeline
  • 26 SEP 12:35Z
    Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal
    cvelistv5