PT-2021-11012
CVE-2020-24141
·
تاريخ النشر
2021-07-07
·
تاريخ التحديث
2021-10-05
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
WP-DownloadManager plugin version 1.68.4
Description:
The issue allows an attacker to send crafted requests from the back-end server of a vulnerable web application via the
file remote parameter to "download-add.php". This can be used to identify open ports, local network hosts, and execute commands on services.Recommendations:
For WP-DownloadManager plugin version 1.68.4, consider disabling access to the "download-add.php" endpoint until a patch is available. Avoid using the
file remote parameter in the affected endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾