CVE-2020-36668 JetBackup – WP Backup, Migrate & Restore <= 1.4.0 - Sensitive Information Disclosure
Subscribers can access sensitive database table information via an unprotected AJAX function in the JetBackup WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36668?
CVE-2020-36668 is a medium-severity vulnerability in backupguard JetBackup – Backup, Restore & Migrate, published on 7 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
Weakness: CWE-200
Which versions are affected by CVE-2020-36668?
It affects 1 product.
Products include Jetbackup Jetbackup.
How do I fix CVE-2020-36668?
No fix has been published for CVE-2020-36668 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36668 being exploited?
There is no known exploitation of CVE-2020-36668 in the wild and no public exploit code.
Other vulnerabilities in backupguard JetBackup – Backup, Restore & Migrate
- CVE-2020-36669 JetBackup – WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
- CVE-2020-36667 JetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change
- CVE-2022-34148 WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-9qwq-rm73-j3gr.