CVE-2024-2098CWE-289

Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

High · published June 13, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-289 · Authentication Bypass by Alternate Name
Published
2024-06-13T05:34Z
EPSS history
Timeline
  • 13 JUN 05:34Z
    Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
    cvelistv5