CVE-2023-1524 Download Manager < 3.2.71 - Broken Access Controls

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any fil...

CVE-2023-1524

The CVE-2023-1524 issue affects the WordPress Download Manager plugin prior to version 3.2.71. According to multiple sources, the vulnerability is an improper access control: during password validation a master key is generated and exposed to the user, which can be used to download any password‑p...

WordPress Download Manager Plugin < 3.2.71 is vulnerable to Broken Access Control

Software Download Manager Type Plugin Vulnerable versions 3.2.71 Fixed in 3.2.71 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1524 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4024de402784 Credits Johan Kragt Required privileg...