CVE-2021-39316: ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
Published Aug 31, 2021
·Updated
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter.
Affected Software
1 affected component
Digitalzoomstudio Zoomsounds Wordpress<=6.45
Event History
Aug 31, 2021
CVE Published
via MITRE·11:05 AM
Data Sourced
via MITRE·11:05 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-39316?
CVE-2021-39316 is classified as a high severity vulnerability due to its potential to expose sensitive files.
2
How do I fix CVE-2021-39316?
To fix CVE-2021-39316, update the Zoomsounds plugin to the latest version that has patched this vulnerability.
3
What type of attack does CVE-2021-39316 facilitate?
CVE-2021-39316 facilitates arbitrary file download attacks due to inadequate input validation in the `link` parameter.
4
What files are at risk due to CVE-2021-39316?
CVE-2021-39316 allows for the unauthorized download of sensitive files such as wp-config.php.
5
Which versions of the Zoomsounds plugin are affected by CVE-2021-39316?
CVE-2021-39316 affects versions of the Zoomsounds plugin up to and including 6.45.