CVE-2023-4930

Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing

CVSS 6.5 MEDIUMEPSS 0.4%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Nov 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Unknown · Front End PM

References

https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2