CVE-2023-7165

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-02-27 09:15

Updated : 2026-06-17 06:52

NVD link : CVE-2023-7165

Mitre link : CVE-2023-7165

CVE.ORG link : CVE-2023-7165

JSON object : View

Products Affected

jetbackup

jetbackup

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-7165", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-7165", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-09T19:07:36.266510Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "JetBackup", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.9.9", "versionType": "semver"}], "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*"], "vendor": "jetbackup", "product": "jetbackup", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.9.9", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2024-02-27T09:15:37.247", "references": [{"url": "https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files."}, {"lang": "es", "value": "El complemento JetBackup de WordPress anterior a 2.0.9.9 no utiliza archivos de \u00edndice para evitar la lista p\u00fablica de directorios confidenciales en ciertas configuraciones, lo que permite a actores malintencionados filtrar archivos de respaldo."}], "lastModified": "2026-06-17T06:52:13.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "D617997C-3D00-418A-A693-77AD7923399E", "versionEndExcluding": "2.0.9.9"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}