CVE-2023-4930

Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing

Medium · published November 6, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.0th percentile
Published
2023-11-06T20:41Z
EPSS history
Timeline
  • 06 NOV 20:41Z
    Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing
    cvelistv5