CVE-2024-3749
Assigner: WPScan
Published: 2024-05-15T06:00:04.713Z
State: PUBLISHED
title: SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR
problemTypes: descriptions: description: CWE-639 Authorization Bypass Through User-Controlled Key
type: CWE
affected: vendor: Unknown
product: SP Project & Document Manager
versions: status: affected
versionType: semver
version: 0
lessThanOrEqual: 4.71
defaultStatus: affected
descriptions: value: The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
credits: value: fewwords
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator