Medium severity · published Nov 27, 2023
CVE-2023-4297
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the…
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mmm Simple File List · Mediamanifesto
through 2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4297
Exploit
https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978
More from Mmm Simple File List
5.4
CVE-2023-4514
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode…