CVE-2022-0828

Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key

highInadequate Encryption Strength

7.5

CVSS Score

7.5

CVSS Score

high

Severity

3.2.39

Patched in

678d

Time to patch

Description

The Download Manager WordPress plugin before 3.2.39 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

High

Confidentiality

None

Integrity

None

Availability

Technical Details

Affected versions<3.2.39

PublishedMarch 16, 2022

Last updatedJanuary 22, 2024

Affected plugindownload-manager

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/feb056b0-5ea0-4257-8d58-0e29b3c304bd?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database