CVE-2023-4930

Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing

CVSS 6.5 MEDIUMEPSS 0.4%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

06 nov 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Produtos afetados

Unknown · Front End PM

Referências

https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2