CVE-2023-4297 Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing

2023-11-2716:22:01

WPScan

www.cve.org

mmm simple file list

authenticated users

arbitrary directories

AI Score

Confidence

High

EPSS

Percentile

14.0%

JSON

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Mmm Simple File List",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "2.3"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]