CVE-2023-7165
JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
Vexday Risk Score
36Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 7.5EPSS 1.9%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
27 Feb 2024Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · JetBackupWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →