CVE-2022-3076CWE-434

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

High · published September 26, 2022

CVSS v3.1
7.2
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01556 · 75.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-09-26T12:35Z
EPSS history
Timeline
  • 26 SEP 12:35Z
    CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
    cvelistv5