CVE-2024-7031

NVD Published Date: August 03, 2024 at 09:15 AM

NVD Last Modified: August 05, 2024 at 12:41 PM

Download Patch

Vulnerability ID

CVE-2024-7031

Severity

HIGH

Severity Score

7.5

Summary

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=cve

https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L566

https://plugins.trac.wordpress.org/changeset/3129722/

Mitigation and Patches

Exploits

Metasploit Payload

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE ID

None

Recent Publish

CVE-2024-7356

CVE-2024-7257

CVE-2024-6872

CVE-2024-6709

2024-07 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10 Version 22H2 for ARM64 (KB5041355)

2024-07 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2 for x64 (KB5041355)

See SecOps Solution
in action

Schedule Demo

Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions

CVE-2024-7031

Recent Publish

See SecOps Solution
in action

Products

Compare

Company

Resources

Try It

CVE-2024-7031

Recent Publish

See SecOps Solutionin action

Products

Compare

Company

Resources

Try It

See SecOps Solution
in action