CVE-2020-7241 Information disclosure in n/a
Attackers can read database backup files by guessing predictable URLs, exposing sensitive data in the WP Database Backup plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7241?
CVE-2020-7241 is a high-severity vulnerability in n/a, published on 20 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.
Weakness: CWE-330
Which versions are affected by CVE-2020-7241?
It affects 1 product.
Products include Wpseeds Wp Database Backup.
How do I fix CVE-2020-7241?
No fix has been published for CVE-2020-7241 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7241 being exploited?
There is no known exploitation of CVE-2020-7241 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jqvr-gmgr-wg44.