CVE-2017-1002008 Missing authorization in membership-simplified-for-oap-members-only
Unauthenticated attackers can download restricted files because the plugin fails to verify user login status and download privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-1002008?
CVE-2017-1002008 is a critical missing authorization vulnerability in William DeAngelis membership-simplified-for-oap-members-only, published on 14 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.
Weakness: CWE-434
Which versions are affected by CVE-2017-1002008?
It affects 1 product.
Products include Membership Simplified Project Membership Simplified.
How do I fix CVE-2017-1002008?
No fix has been published for CVE-2017-1002008 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-1002008 being exploited?
There is no known exploitation of CVE-2017-1002008 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-4c9r-fcrv-f86f.