// For flags

CVE-2023-6114

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.

El complemento Duplicator WordPress anterior a 1.5.7.1 y Duplicator Pro WordPress anterior a 4.5.14.2 no impiden incluir el directorio `backups-dup-lite/tmp` (o el directorio `backups-dup-pro/tmp` en la versión Pro) , que almacena temporalmente archivos que contienen datos confidenciales. Cuando la lista de directorios está habilitada en el servidor web, esto permite a atacantes no autenticados descubrir y acceder a estos archivos confidenciales, que incluyen un volcado completo de la base de datos y un archivo zip del sitio.

Duplicator and Duplicator Pro for WordPress are vulnerable to Sensitive Information Exposure in various versions. This makes it possible for unauthenticated attackers to download sensitive information/files leading to the potential for a complete site takeover.

WordPress Duplicator plugin versions prior to 1.5.7.1 suffer from an unauthenticated sensitive data exposure vulnerability that can lead to account takeover.

*Credits: Dmitrii Ignatyev, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-11-13 CVE Reserved
  • 2023-12-04 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-11-25 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-552: Files or Directories Accessible to External Parties
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Awesomemotive
Search vendor "Awesomemotive"
 Duplicator
Search vendor "Awesomemotive" for product "Duplicator"
 < 1.5.7.1
Search vendor "Awesomemotive" for product "Duplicator" and version " < 1.5.7.1"
wordpress
Affected
Awesomemotive
Search vendor "Awesomemotive"
 Duplicator
Search vendor "Awesomemotive" for product "Duplicator"
 < 4.5.14.2
Search vendor "Awesomemotive" for product "Duplicator" and version " < 4.5.14.2"
pro, wordpress
Affected