CVE-2023-4297

2023-11-2717:15:08

WPScan

web.nvd.nist.gov

mmm simple file list

wordpress

plugin

unauthorized access

file listing

nvd

cve-2023-4297

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

14.0%

JSON

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

mediamanifestommm_simple_file_listRange≤2.3wordpress

VendorProductVersionCPE
mediamanifestommm_simple_file_list*cpe:2.3:a:mediamanifesto:mmm_simple_file_list:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
mediamanifesto	mmm_simple_file_list	*	cpe:2.3:a:mediamanifesto:mmm_simple_file_list::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Mmm Simple File List",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "2.3"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]