6.5
Medium
CVE-2022-3511 The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded…
Description
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Awesome Support 6.1 | earliest → < 6.1.2 | 6.1.2 |
Other CVEs of Awesome Support
The 4 CVEs of Awesome Support →
CVE-2023-5355
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files,…
8.1
High
CVE-2023-5352
The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing…
4.3
Medium
CVE-2023-5354
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back…
6.1
Medium