CVE-2020-24312 Information disclosure in n/a
Unauthenticated attackers can browse and download sensitive site backups, including database dumps, due to missing access restrictions in the WP File Manager plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24312?
CVE-2020-24312 is a high-severity vulnerability in n/a, published on 26 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.
Weakness: CWE-552
Which versions are affected by CVE-2020-24312?
It affects 1 product.
Products include Filemanagerpro File Manager.
How do I fix CVE-2020-24312?
No fix has been published for CVE-2020-24312 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-24312 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-24312 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution
- CVE-2018-25105 File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
- CVE-2024-8507 File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-1538 File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
- CVE-2023-6846 File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload
Sources
Also known as GHSA-2652-63hr-2gvh.