CVE-2023-4930 Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing
Unauthenticated attackers can list and download private message attachments if the web server's autoindex feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4930?
CVE-2023-4930 is a medium-severity vulnerability in Unknown Front End PM, published on 6 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
Weakness: CWE-552
Which versions are affected by CVE-2023-4930?
It affects 1 product.
Products include Shamimsplugins Front End Pm.
How do I fix CVE-2023-4930?
No fix has been published for CVE-2023-4930 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4930 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4930 exists.
Sources
Also known as GHSA-p7f5-95m3-2fw7.