The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7 | Exploit Third Party Advisory |
Configurations
History
16 Feb 2024, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Awsm wp Job Openings
|
|
| CPE | cpe:2.3:a:awsm:wp_job_openings:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-552 |
20 Oct 2023, 12:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7 - Exploit, Third Party Advisory | |
| First Time |
Awsm
Awsm job Openings |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:awsm:job_openings:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-668 |
16 Oct 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-16 20:15
Updated : 2024-02-16 18:57
NVD link : CVE-2023-4933
Mitre link : CVE-2023-4933
CVE.ORG link : CVE-2023-4933
JSON object : View
Products Affected
awsm
- wp_job_openings
CWE
CWE-552
Files or Directories Accessible to External Parties