CVE-2022-0828: unknown download manager
Vulnerability summary
CVE-2022-0828 is a high (CVSS 7.5) vulnerability in unknown download manager. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.2.39.
Timeline
- 11-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.53%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.53% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected systems
Unknown1 product
- download manager< 3.2.34
W3eden1 product
- download_manager< 3.2.34
Wordpress1 product
- download-manager< 3.2.39
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bbExploitVDB EntryTechnical DescriptionThird Party Advisory