CVE-2024-13126: falha de média gravidade em Download Manager
Download Manager < 3.3.07 - Unauthenticated Data Exposure
Publicada em · Atualizada em
28Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 4.6epss 0.5%
probabilidade de exploração
0.5%top 61% das CVEs
exploração observada
nãonenhuma fonte reporta
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
Unknown · Download ManagerCVEs relacionadas — Download Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2023-6421HIGHDownload Manager < 3.2.83 - Unauthenticated Protected File Download Password LeakEPSS 2.4%CVE-2022-2926MEDIUMDownload Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path TraversalEPSS 1.7%CVE-2022-0828—Download Manager < 3.2.39 - Unauthenticated brute force of files master keyEPSS 1.5%CVE-2021-25087—Wordpress Download Manager < 3.2.25 - Sensitive Information DisclosureEPSS 1.5%CVE-2021-25069—WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSEPSS 1.5%CVE-2022-2168—Download Manager < 3.2.44 - Reflected Cross-Site ScriptingEPSS 1.4%