CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

2024-02-2708:30:30

WPScan

github.com

cve-2023-7165; jetbackup; directory listing; exposing backups; wordpress plugin; index files; sensitive directories; malicious actors; backup files

AI Score

6.5

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

The JetBackup WordPress plugin before 2.0.9.9 doesn’t use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "jetbackup",
    "product": "jetbackup",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.0.9.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]