CVE-2024-52378: WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerability
Published Nov 14, 2024
·Updated
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This issue affects DigiPass: from n/a through <= 0.3.0.
Affected Software
1 affected component
Labs64 WordPress DigiPass plugin<=0.3.0
Event History
Nov 14, 2024
CVE Published
via MITRE·05:41 PM
Data Sourced
via MITRE·05:41 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-52378?
CVE-2024-52378 is considered a critical severity vulnerability due to its potential for absolute path traversal.
2
How do I fix CVE-2024-52378?
To fix CVE-2024-52378, update Labs64 DigiPass and any affected plugins to versions above 0.3.0.
3
What types of attacks can be executed using CVE-2024-52378?
CVE-2024-52378 can be exploited to perform arbitrary file downloads from the server due to improper pathname limitations.
4
Which versions of DigiPass are affected by CVE-2024-52378?
CVE-2024-52378 affects Labs64 DigiPass versions up to and including 0.3.0.
5
Is the WordPress DigiPass plugin also vulnerable to CVE-2024-52378?
Yes, the WordPress DigiPass plugin versions up to 0.3.0 are also vulnerable to CVE-2024-52378.