CVE-2022-0828 Master Key bruteforce Wordpress Download Manager plugin

1. Vulnerability Properties

Title: Master Key bruteforce Wordpress Download Manager plugin
CVE ID: CVE-2022-0828
CVSSv3 Base Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Vendor: W3 Eden, Inc
Products: Wordpress Download Manager plugin
Advisory Release Date: 22-07-2022
Advisory URL: https://labs.integrity.pt/advisories/cve-2022-0828
Credits: Discovery by Diogo Real <dr[at]integrity.pt>

2. Vulnerability Summary

Due to the use of the function uniqid to generate files “master keys” is it possible for an unauthenticated attacker to bypass files protected by password, or roles restrictions mechanisms by bruteforcing the master key value.

3. Vulnerable Versions

• < 3.2.39

4. Solution

• Update to version 3.2.4 or higher

5. Vulnerability Timeline

• 2/Mar/22  - Bug reported
• 22/Jul/22 - Advisory released

6. References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0828
• https://wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bb