PT-2024-11909 · WordPress · Download Monitor

Published 2024-10-15 · Updated 2024-10-30 · CVE-2022-4972

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Monitor plugin for WordPress versions up to, and including, 4.7.51

Description The issue is related to a missing capability check on several REST-API routes, specifically those related to reporting, which allows unauthenticated attackers to bypass authorization. This enables them to view user data and other sensitive information intended for administrators.

Recommendations For versions up to, and including, 4.7.51, update the Download Monitor plugin to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the REST-API routes related to reporting until the update is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-4972

Affected Products

Download Monitor

References · 8

• https://osv.dev/vulnerability/CVE-2022-4972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4972 · Security Note
• https://twitter.com/cracbot/status/1848242898489544839 · Twitter Post
• https://twitter.com/oktsec/status/1846485646434529724 · Twitter Post
• https://t.me/cvedetector/8017 · Telegram Post
• https://twitter.com/CVEnew/status/1846444813140344940 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a9000c52-fdd7-43e2-ae6a-9f127c4a9fcd?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/2822758/download-monitor/trunk/src/Admin/Reports/class-dlm-reports.php?contextall=1&old=2821522&old_path=%2Fdownload-monitor%2Ftrunk%2Fsrc%2FAdmin%2FReports%2Fclass-dlm-reports.php · Note