CVE-2024-5599

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Insecure Storage of Sensitive Information pada fileorganizer. Skor CVSS 3.1 7.5 (High) menurut wordfence.com.

Deskripsi (NVD)

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.

Rincian

Terbit di NVD

7 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3098763/ patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7b65d-91f8-477e-b992-3148c1b65d7b?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/ajax.php#L85 product