PT-2021-16200 · WordPress · Simple Download Monitor

Apple502J · Published 2021-11-08 · Updated 2022-11-09 · CVE-2021-24695

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simple Download Monitor WordPress plugin versions prior to 3.9.6

Description The issue allows unauthenticated users to download and read logs containing sensitive information, such as IP addresses and usernames, due to the logs being saved in a predictable location without any authentication or authorization in place.

Recommendations For versions prior to 3.9.6, update to version 3.9.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files to prevent unauthenticated users from downloading and reading them.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2021-24695

Affected Products

Simple Download Monitor

References · 6

• 🔥 https://wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24695 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24695 · Vendor Advisory
• https://t.me/cvenotify/33909 · Telegram Post
• https://t.me/cvenotify/23150 · Telegram Post
• https://t.me/cibsecurity/32008 · Telegram Post