Description
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Download Manager | unaffected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-15876 | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download. |
References
History
Fri, 21 Mar 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
W3eden
W3eden download Manager |
|
| CPEs | cpe:2.3:a:w3eden:download_manager:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Wpdownloadmanager
Wpdownloadmanager wordpress Download Manager |
W3eden
W3eden download Manager |
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2024-08-02T23:40:04.424Z
Reserved: 2022-03-02T00:00:00.000Z
Link: CVE-2022-0828
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-04-11T15:15:08.480
Modified: 2025-03-21T16:07:09.227
Link: CVE-2022-0828
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses