Vulners
Lucene search
WordPress Download Manager < 3.1.25 - Authenticated Directory Traversal
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2021-34638 | 5 Aug 202121:15 | – | attackerkb |
 | CVE-2021-34638 | 6 Aug 202100:31 | – | circl |
 | WordPress plugin Download Manager 路径遍历漏洞 | 5 Aug 202100:00 | – | cnnvd |
 | CVE-2021-34638 | 5 Aug 202120:18 | – | cve |
 | CVE-2021-34638 WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal | 5 Aug 202120:18 | – | cvelist |
 | EUVD-2021-21288 | 7 Oct 202500:30 | – | euvd |
 | CVE-2021-34638 | 5 Aug 202121:15 | – | nvd |
 | CVE-2021-34638 | 5 Aug 202121:15 | – | osv |
 | Directory traversal | 5 Aug 202121:15 | – | prion |
 | CVE-2021-34638 | 22 May 202519:51 | – | redhatcve |
10
| Source | Link |
|---|---|
| wordfence | www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/ |
As a contributor, it is possible to retrieve the contents of a site’s wp-config.php file by performing the following steps:
Login as a contributor user and go to Downloads->Add New. Name the post, and intercept the request when you Submit for Review (no file needs to be uploaded).
In the file[page_template] parameter, swap out page-template-1col-flat.php for “\\../../../../../wp-config.php”
Then preview the page. The contents of the wp-config.php file will be visible in the page source.
The reason this is possible is due to the wpdm_basename function in wpdm-functions.php. After removing the initial “\\” from the parameter value, it returns ../../../../../wp-config.php as the basename.
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Jul 2021 16:27Current
6.2Medium risk
Vulners AI Score6.2
EPSS0.01331