CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2436 – Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
https://notcve.org/view.php?id=CVE-2022-2436
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. El plugin Download Manager para WordPress es vulnerable a una deserialización de entradas no confiables por medio del parámetro "file[package_dir]" en versiones hasta 3.2.49 incluyéndola. Esto hace posible a atacantes autenticados con privilegios de contribuyente y superiores llamar a archivos usando una envoltura PHAR que de serializará los datos y llamará a Objetos PHP arbitrarios que pueden ser usados para llevar a cabo una variedad de acciones maliciosas concedidas una cadena POP también está presente. • https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L68 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php&new=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php https://www.wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2436 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34347 – WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-34347
Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin W3 Eden Download Manager versiones anteriores a 3.2.48 incluyéndola, en WordPress. The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.48. This is due to missing or incorrect nonce validation on the updateTemplateStatus function. This makes it possible for unauthenticated attackers to trigger setting changes forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-cross-site-request-forgery-csrf-vulnerability https://wordpress.org/plugins/download-manager/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36288 – WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
https://notcve.org/view.php?id=CVE-2022-36288
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. Múltiples vulnerabilidades de tipo Cross-Site Request Forgery (CSRF) en el plugin W3 Eden Download Manager versiones anteriores a 3.2.48 incluyéndola, en WordPress. The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.48. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to delete stats and clear the plugin's cache via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-multiple-cross-site-request-forgery-csrf-vulnerabilities https://wordpress.org/plugins/download-manager/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2362 – Download Manager < 3.2.50 - Bypass IP Address Blocking Restriction
https://notcve.org/view.php?id=CVE-2022-2362
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions. El plugin Download Manager de WordPress versiones anteriores a 3.2.50, prioriza la obtención de la IP de un visitante a partir de determinados encabezados HTTP por encima de REMOTE_ADDR de PHP, lo que permite omitir las restricciones de bloqueo de descargas basadas en la IP. The Download Manager plugin for WordPress is vulnerable to IP Blocking Bypass in versions up to, and including, 3.2.49 due to the way the visitor's IP address is determined. This allows an unauthenticated attacker to spoof their IP address to obtain access to files that are protected by this functionality. • https://wpscan.com/vulnerability/d94b721e-9ce2-45e5-a673-2a57b0137653 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-290: Authentication Bypass by Spoofing •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 1CVE-2022-2431 – Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2022-2431
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server. El plugin Download Manager para WordPress es vulnerable a la eliminación arbitraria de archivos en versiones hasta 3.2.50 incluyéndola. • https://packetstormsecurity.com/files/167920/wpdownloadmanager3250-filedelete.txt https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail= https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-in-download-manager-plugin • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-73: External Control of File Name or Path CWE-610: Externally Controlled Reference to a Resource in Another Sphere •