CVE-2023-6114

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

published December 26, 2023

CVSS
—
EPSS
31%
Percentile
98.3
In the wild
Unconfirmed
What it is

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.30894 · 98.3th percentile
Published
2023-12-26T18:33Z
EPSS history
Timeline
  • 26 DEC 18:33Z
    Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
    cvelistv5