CVE-2023-4297 Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing
Authenticated users can list contents of arbitrary directories due to lack of path validation in the Mmm Simple File List plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4297?
CVE-2023-4297 is a medium-severity path traversal vulnerability in Unknown Mmm Simple File List, published on 27 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
Which versions are affected by CVE-2023-4297?
It affects 1 product.
Products include Mediamanifesto Mmm Simple File List.
How do I fix CVE-2023-4297?
No fix has been published for CVE-2023-4297 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-4297 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4297 exists.
Other vulnerabilities in Unknown Mmm Simple File List
Sources
Also known as GHSA-732v-mmfh-p7hp.