CVE-2023-6785: Download Manager <= 3.2.84 - Missing Authorization

Q: What is the severity of CVE-2023-6785?

CVE-2023-6785 is classified as a critical vulnerability due to the potential for unauthorized file access.

Q: How do I fix CVE-2023-6785?

To fix CVE-2023-6785, update the WordPress Download Manager plugin to version 3.2.85 or higher.

Q: Who is affected by CVE-2023-6785?

Anyone using the Download Manager plugin for WordPress in versions up to and including 3.2.84 is affected by CVE-2023-6785.

Q: What type of vulnerability is CVE-2023-6785?

CVE-2023-6785 is an unauthorized file download vulnerability.

Q: Can an attacker exploit CVE-2023-6785 without authentication?

Yes, CVE-2023-6785 allows unauthenticated attackers to exploit the vulnerability to download files.

Published Mar 13, 2024

Updated

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).

Affected Software

2 affected components

WordPress Download Manager<=3.2.84

W3eden Download Manager Wordpress<3.2.85

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038209%40download-manager%2Ftrunk&old=3022104%40download-manager%2Ftrunk&sfp_email=&sfph_mail=

Event History

Mar 13, 2024

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-6785?

CVE-2023-6785 is classified as a critical vulnerability due to the potential for unauthorized file access.

How do I fix CVE-2023-6785?

To fix CVE-2023-6785, update the WordPress Download Manager plugin to version 3.2.85 or higher.

Who is affected by CVE-2023-6785?