CVE-2021-39316 — ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure

Description (CNA)

The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.

Affected (CNA)

Vendor / product	Versions
ZoomIt / ZoomSounds - WordPress Wave Audio Player with Playlist	affected 6.45 through 6.45

CWE

CWE-22, CWE-552

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39316
http://packetstormsecurity.com/files/165146/WordPress-DZS-Zoomsounds-6.45-Arbitrary-File-Read.html

ADP enrichment

CVE

No English description supplied.

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39316
http://packetstormsecurity.com/files/165146/WordPress-DZS-Zoomsounds-6.45-Arbitrary-File-Read.html

CISA-ADP

No English description supplied.

No references supplied.