CVE-2024-2098
EUVD-2024-2706213.06.2024, 06:15
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| w3eden | download_manager | 𝑥 < 3.2.90 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-289 - Authentication Bypass by Alternate NameThe software performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References