CVE-2024-1076: SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1076?
CVE-2024-1076 is considered a high severity vulnerability due to its potential to expose sensitive private keys.
How do I fix CVE-2024-1076?
To mitigate CVE-2024-1076, upgrade the SSL Zen WordPress plugin to version 4.6.0 or later immediately.
What type of vulnerability is CVE-2024-1076?
CVE-2024-1076 is a directory listing vulnerability that allows unauthorized access to private keys.
Who is affected by CVE-2024-1076?
CVE-2024-1076 affects users of the SSL Zen WordPress plugin versions prior to 4.6.0.
What can an attacker do with CVE-2024-1076?
An attacker can potentially read sensitive private keys from the private keys folder if they gain access due to the vulnerability.