CVE-2023-7165

JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

Affected

JetBackup

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.92% chance of exploitation in the next 30 days, 80th percentile

Nuclei

high · CWE-548

Published

2024-02-27

Updated

2024-08-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7165.yaml

Security advisories

• https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe

References

• CVE Record
• NVD entry