CVE-2023-5907
Assigner: WPScan
Published: 2023-12-11T19:22:37.067Z
State: PUBLISHED
title: File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal
problemTypes: descriptions: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
affected: vendor: Unknown
product: File Manager
versions: status: affected
versionType: semver
version: 0
lessThan: 6.3
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
credits: value: Dmitrii Ignatyev
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator