CVE-2023-4297 Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing

2023-11-2716:22:01

WPScan

github.com

cve-2023-4297

wordpress plugin

arbitrary directory listing

AI Score

6.7

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mmm_simple_file_list:mmm_simple_file_list:2.3:*:*:*:*:*:*:*"
    ],
    "vendor": "mmm_simple_file_list",
    "product": "mmm_simple_file_list",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2.3"
      }
    ],
    "defaultStatus": "unknown"
  }
]