CVE-2023-3664 FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access

Q: What is CVE-2023-3664?

CVE-2023-3664 is a high-severity missing authorization vulnerability in Unknown FileOrganizer, published on 25 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2023-3664 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3664 exists.

Q: How do I fix CVE-2023-3664?

No fix has been published for CVE-2023-3664 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 25 Sep 2023 Updated 23 Sep 2024

Site admins on multisite instances can access arbitrary files and gain full server control due to missing authorization checks in the FileOrganizer plugin.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-3664?

CVE-2023-3664 is a high-severity missing authorization vulnerability in Unknown FileOrganizer, published on 25 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.

Which versions are affected by CVE-2023-3664?

It affects 1 product.

Products include Fileorganizer Fileorganizer.

How do I fix CVE-2023-3664?

No fix has been published for CVE-2023-3664 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-3664 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3664 exists.

Sources

Also known as GHSA-r5cj-522q-85p9.