CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

2024-02-2708:30:30

WPScan

www.cve.org

cve

jetbackup

wordpress

directory listing

exposing backups

sensitive directories

malicious actors

backup files

AI Score

6.4

Confidence

High

EPSS

Percentile

9.0%

JSON

The JetBackup WordPress plugin before 2.0.9.9 doesn’t use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "JetBackup",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.0.9.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]