Download Manager, bc88aa10-b861-4426-8bcd-ab1b4a2214ab

CVE, Research URL: bc88aa10-b861-4426-8bcd-ab1b4a2214ab
Home page URL: Security reports for Download Manager
Application: Download Manager
Published on: -
Research Description: Download Manager [download-manager] < 3.1.23 Download Manager < 3.1.23 - Unauthorised Asset Manager Usage The majority of the AJAX actions related to the Asset Manager use the same nonce action (ie the NONCE_KEY constant), and are lacking any authorisation checks. Given that the nonce is available in other pages, accessible by low priviledge users (such as author, or even subscribers depending on the plugin's feature used), this could lead to unauthorised use of the Asset Manager. Exploitation of the mkDir, newFile, scanDir, createZip, unZip, deleteItem, openFile, fileSettings, saveFile, moveItem, copyItem would be quite difficult to achieve, as their file/path parameters are encrypted using SECURE_AUTH_KEY or NONCE_SALT, nonetheless, they should be properly secured. However, the addComment, addShareLink, getLinkDet, updateLink, deleteLink and renameItem can be exploited.
Affected versions: max 3.1.23.
Status: vulnerable