Skip to main content

Sp Project Document Manager CVE-2024-3749

MEDIUM
2024-05-15 contact@wpscan.com
WordPress Information Disclosure Sp Project Document Manager
6.5
CVSS 3.1 · Vendor: wpscan
Share

Severity by source

Vendor (wpscan) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (wpscan) · only source for this CVE.

CVSS VectorVendor: wpscan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 15, 2024 - 06:15 cve.org
MEDIUM 6.5

DescriptionCVE.org

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user

AnalysisAI

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user Affected products include: Smartypantsplugins Sp Project \& Document Manager. Version information: through 4.71.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sp Project Document Manager

View all
CVE-2021-24347 HIGH POC
8.8 Jun 14

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempt
CVE-2014-9178 HIGH POC
7.5 Dec 02

Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
CVE-2024-3748 MEDIUM POC
6.5 May 15

The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a
CVE-2022-1551 MEDIUM POC
6.5 Jul 25

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad ac
CVE-2021-38315 MEDIUM POC
6.1 Aug 16

The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via t
CVE-2023-3063 HIGH
8.8 Jun 30

The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up
CVE-2024-24868 HIGH
8.5 Feb 28

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Pro
CVE-2024-37224 MEDIUM
6.5 Jul 09

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project &
CVE-2022-34857 MEDIUM
6.1 Aug 22

Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPr
CVE-2023-36530 MEDIUM
4.8 Aug 10

Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-3749 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy