CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
Attackers can access sensitive backup files via directory listing in specific configurations of the JetBackup WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7165?
CVE-2023-7165 is a high-severity vulnerability in Unknown JetBackup, published on 27 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
Which versions are affected by CVE-2023-7165?
It affects 1 product.
Products include Jetbackup Jetbackup.
How do I fix CVE-2023-7165?
No fix has been published for CVE-2023-7165 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-7165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7165 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown JetBackup
- CVE-2020-36669 JetBackup – WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2020-36667 JetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change
- CVE-2022-34148 WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2020-36668 JetBackup – WP Backup, Migrate & Restore <= 1.4.0 - Sensitive Information Disclosure
Sources
Also known as GHSA-p53g-6cxv-378j.