CVE-2024-0761CWE-330

File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames

High · published February 5, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01029 · 63.4th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2024-02-05T21:21Z
EPSS history
Timeline
  • 05 FEB 21:21Z
    File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames
    cvelistv5