{"id":"CVE-2023-3814","state":"PUBLISHED","title":"Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access","description":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.","publishedAt":"2023-09-04T11:27:01.778Z","updatedAt":"2025-03-06T16:03:22.116Z","severity":{"score":4.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Advanced File Manager"],"affected":[{"vendor":"Unknown","product":"Advanced File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3814.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3814","state":"PUBLISHED","datePublished":"2023-09-04T11:27:01.778Z","dateUpdated":"2025-03-06T16:03:22.116Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-07-20T20:10:07.465Z"},"containers":{"cna":{"title":"Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access","descriptions":[{"lang":"en","value":"The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server."}],"affected":[{"vendor":"Unknown","product":"Advanced File Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2023-09-15T18:08:18.643Z"},"credits":[{"lang":"en","value":"Dmitrii","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:08:50.434Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-03-06T16:02:45.834783Z","id":"CVE-2023-3814","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-06T16:03:22.116Z"}}]}}}