CVE-2024-9765 - Vulnerability Details - OpenCVE

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00064.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Lukashuser	Ekc Tournament Manager

Configuration 1 [-]

cpe:2.3:a:lukashuser:ekc_tournament_manager:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2025-15201	The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/

History

Wed, 28 May 2025 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lukashuser Lukashuser ekc Tournament Manager
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:lukashuser:ekc_tournament_manager::::::wordpress::*
Vendors & Products		Lukashuser Lukashuser ekc Tournament Manager

Fri, 16 May 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory
Title		EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability
References		https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-05-15T20:07:23.119Z

Updated: 2025-05-16T20:28:21.213Z

Reserved: 2024-10-09T19:48:06.956Z

Link: CVE-2024-9765

Vulnrichment

Updated: 2025-05-16T20:28:13.148Z

NVD

Status : Analyzed

Published: 2025-05-15T20:16:01.283

Modified: 2025-05-28T15:40:49.787

Link: CVE-2024-9765

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9765", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-10-09T19:48:06.956Z", "datePublished": "2025-05-15T20:07:23.119Z", "dateUpdated": "2025-05-16T20:28:21.213Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-15T20:07:23.119Z"}, "title": "EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability", "problemTypes": [{"descriptions": [{"description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "EKC Tournament Manager", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.2.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory"}], "references": [{"url": "https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Vuln Seeker Cybersecurity Team", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-16T20:27:42.396793Z", "id": "CVE-2024-9765", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-16T20:28:21.213Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-9765", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-16T20:27:42.396793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-16T20:28:13.148Z"}}], "cna": {"title": "EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Vuln Seeker Cybersecurity Team"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "EKC Tournament Manager", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-15T20:07:23.119Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9765", "state": "PUBLISHED", "dateUpdated": "2025-05-16T20:28:21.213Z", "dateReserved": "2024-10-09T19:48:06.956Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-05-15T20:07:23.119Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}