CVE-2024-5598: Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fmalocalfilesystem' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/advanced-file-managerto a version that resolves this vulnerability.Fixed in 5.2.4 - Configuration
Prevent access to the vulnerable 'fma_local_file_system' function used for directory listing to stop unauthenticated extraction of sensitive files (e.g., those in the built-in Trash folder).
Advanced File Manager (WordPress plugin) fma_local_file_system = disable or remove the vulnerable function exposure
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5598?
CVE-2024-5598 is classified as a critical vulnerability due to its potential to expose sensitive information to unauthenticated attackers.
How do I fix CVE-2024-5598?
To fix CVE-2024-5598, update the Advanced File Manager plugin to version 5.2.5 or later.
What type of data can be exposed by CVE-2024-5598?
CVE-2024-5598 can allow unauthorized access to sensitive data, including backups and other stored files.
Which versions of the Advanced File Manager are affected by CVE-2024-5598?
CVE-2024-5598 affects all versions up to and including 5.2.4 of the Advanced File Manager plugin.
Can unauthenticated users exploit CVE-2024-5598?
Yes, CVE-2024-5598 can be exploited by unauthenticated users, making it particularly dangerous.