CVE-2024-7315 - Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

Back Back to CVE browser

HIGH

Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

Published Oct 2, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.58%

Description

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.

Affected products

Vendor n/a Product Migration, Backup, Staging Default
unaffected
- Version
  0.9.103
  Status
  affected
  Constraints
  <0.9.106

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Migration, Backup, Staging

unaffected

Version	Status	Constraints
0.9.103	affected	<0.9.106

Vendor Wpvivid Team Product Migration Backup Staging Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <0.9.106

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wpvivid Team

Migration Backup Staging

n/a

Version	Status	Constraints
0	affected	<0.9.106

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-338

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48256
Advisory
https://wpscan.com/vulnerability/456b728b-a451-4afb-895f-850ddc4fb589/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48256		Advisory
https://wpscan.com/vulnerability/456b728b-a451-4afb-895f-850ddc4fb589/		exploitvdb-entrytechnical-descriptionThird Party Advisory