CVE-2022-2552

Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.

Affected

Duplicator

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

12.03% chance of exploitation in the next 30 days, 96th percentile

Nuclei

medium · CWE-862

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (2)

• SecuriTrust/CVEsLab/tree/main/CVE-2022-25521★ · 2022-08-05
• https://wpscan.com/vulnerability/6b540712-fda5-4be6-ae4b-bd30a9d9d698

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2552.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50993

References

• CVE Record
• NVD entry

Related

• CVE-2022-2551