High severity · published Nov 8, 2021
CVE-2021-24695
Simple Download Monitor < 3.9.6 - Unauthenticated Log Access
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Simple Download Monitor ·
3.9.6 before 3.9.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24695
Exploit
https://wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25
More from Simple Download Monitor
9.0
CVE-2021-24693
Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail
8.8
CVE-2021-24696
Simple Download Monitor < 3.9.9 - Multiple CSRF
6.5
CVE-2021-24692
Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal
6.1
CVE-2021-24697
Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting
5.4
CVE-2021-24694
Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes