CVE-2024-1076
Assigner: WPScan
Published: 2024-05-08T06:00:02.175Z
State: PUBLISHED
title: SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access
problemTypes: descriptions: description: CWE-287 Improper Authentication
type: CWE
affected: vendor: Unknown
product: SSL Zen 
versions: status: affected
versionType: semver
version: 0
lessThan: 4.6.0
defaultStatus: unaffected
descriptions: value: The SSL Zen  WordPress plugin before 4.6.0 only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
credits: value: Krzysztof Zając (CERT PL)
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator