CVE-2022-0828: Download Manager < 3.2.39 - Unauthenticated brute force of files master key
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0828?
CVE-2022-0828 has a medium severity rating due to its potential to allow unauthorized access to downloads.
How do I fix CVE-2022-0828?
To fix CVE-2022-0828, update the WordPress Download Manager plugin to version 3.2.34 or later.
What systems are affected by CVE-2022-0828?
CVE-2022-0828 affects the WordPress Download Manager plugin versions prior to 3.2.34.
What vulnerability does CVE-2022-0828 exploit?
CVE-2022-0828 exploits the use of the uniqid PHP function to generate insecure master keys for downloads.
Can CVE-2022-0828 affect user access controls?
Yes, CVE-2022-0828 can circumvent role-based access restrictions and password protection for downloads.