CVE-2024-13126: medium-severity vulnerability in Download Manager
Download Manager < 3.3.07 - Unauthenticated Data Exposure
Published · Updated
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 4.6epss 0.5%
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
Unknown · Download ManagerRelated CVEs — Download Manager
In the same product, most dangerous first.
CVE-2023-6421HIGHDownload Manager < 3.2.83 - Unauthenticated Protected File Download Password LeakEPSS 2.4%CVE-2022-2926MEDIUMDownload Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path TraversalEPSS 1.7%CVE-2022-0828—Download Manager < 3.2.39 - Unauthenticated brute force of files master keyEPSS 1.5%CVE-2021-25087—Wordpress Download Manager < 3.2.25 - Sensitive Information DisclosureEPSS 1.5%CVE-2021-25069—WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSEPSS 1.5%CVE-2022-2168—Download Manager < 3.2.44 - Reflected Cross-Site ScriptingEPSS 1.4%