PT-2024-30393 · Unknown · Shared Files

Abdi Pranata · Published 2024-08-26 · Updated 2024-09-18 · CVE-2024-43230

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shared Files versions 1.7.28 and earlier

Description The issue is related to the exposure of sensitive information to an unauthorized actor, specifically in the Shared Files – File Upload Form. This is a problem where sensitive data can be accessed by someone who should not have access to it.

Recommendations For versions 1.7.28 and earlier, upgrade to version 1.7.29 to remediate the issue. As a temporary workaround, consider restricting access to the Shared Files – File Upload Form until the upgrade is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

CVE-2024-43230

Affected Products

Shared Files

References · 7

• https://osv.dev/vulnerability/CVE-2024-43230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43230 · Security Note
• https://t.me/cvenotify/92281 · Telegram Post
• https://patchstack.com/database/vulnerability/shared-files/wordpress-shared-files-premium-download-manager-secure-file-sharing-with-frontend-file-upload-plugin-1-7-28-sensitive-data-exposure-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1828171128696905950 · Twitter Post
• https://twitter.com/transilienceai/status/1829585389620740289 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-premium-download-manager-secure-file-sharing-with-frontend-file-upload-plugin-1-7-28-sensitive-data-exposure-vulnerability?_s_id=cve · Note