1. Home
  2. CVE Database
  3. CVE-2023-5907
MEDIUM · 6.5

CVE-2023-5907

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to syste...

Vulnerability Description

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
BitappsFile Manager< 6.3

Related Weaknesses (CWE)

CWE-552

References

FAQ

What is CVE-2023-5907?

CVE-2023-5907 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to syste...

How severe is CVE-2023-5907?

CVE-2023-5907 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-5907?

Check the references section above for vendor advisories and patch information. Affected products include: Bitapps File Manager.