CVE-2023-6114: Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory (or the backups-dup-pro/tmp directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6114?
CVE-2023-6114 has a high severity rating due to the potential exposure of sensitive data.
How do I fix CVE-2023-6114?
To fix CVE-2023-6114, upgrade the Duplicator plugin to version 1.5.7.1 or later, or Duplicator Pro to version 4.5.14.2 or later.
What type of data is at risk with CVE-2023-6114?
CVE-2023-6114 risks exposing sensitive data temporarily stored in the `backups-dup-lite/tmp` and `backups-dup-pro/tmp` directories.
Are both free and Pro versions affected by CVE-2023-6114?
Yes, both the Duplicator free version and the Pro version are affected by CVE-2023-6114.
What versions of Duplicator are vulnerable to CVE-2023-6114?
Versions prior to 1.5.7.1 for the Duplicator plugin and 4.5.14.2 for the Duplicator Pro plugin are vulnerable to CVE-2023-6114.