Vulnerability in <= 3.3.72?

Resolved zantafio
(@zantafio)

4 days ago

Good afternoon, according to Patchstack, the Download Manager plugin version <= 3.3.72 is vulnerable to sensitive data exposure and there is no official patch available. On other websites, the warning only applies up to version < 3.3.72. My question is: is version 3.3.72 secure, or is there currently still a security vulnerability for which no patch is yet available?

The page I need help with: [log in to see the link]

Viewing 10 replies - 1 through 10 (of 10 total)

Plugin Support Tahasin
(@tahasin)

4 days ago

Hi @zantafio
Thanks for reaching out.
Yes, v3.3.72 is secure and you can update the plugin.
NHWS
(@nhws)

2 days, 22 hours ago
No it’s not secure: https://patchstack.com/database/wordpress/plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-71-sensitive-data-exposure-vulnerability. The warning is: WordPress Download Manager Plugin <= 3.3.72 is vulnerable to Sensitive Data Exposure
- This reply was modified 2 days, 22 hours ago by NHWS.
- This reply was modified 2 days, 22 hours ago by NHWS.
Thread Starter zantafio
(@zantafio)

2 days, 18 hours ago

@nhws, it was precisely because of that warning on Patchstack that I asked. I recently had a similar issue with another plugin; according to the plugin provider, the latest version was safe, but the information on Patchstack hadn’t been updated yet. I hope that’s the case here too…
Plugin Support Tahasin
(@tahasin)

2 days, 12 hours ago
Yes, that might be the case for patchstack @zantafio
There is no vulnerability in v3.3.72. You can also check here:
https://wpscan.com/plugin/download-manager/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager
- This reply was modified 2 days, 12 hours ago by Tahasin.
- This reply was modified 2 days, 12 hours ago by Tahasin.
NHWS
(@nhws)

2 days, 9 hours ago

@tahasin, please request an update at PatchStack then. This is also in your benefit as PatchStack is leading and a lot of users will have the same problem.

Plugin Support Tahasin
(@tahasin)

2 days, 8 hours ago

Hi @nhws
We are investigating the issue and will provide an update here as soon as we have more information.

Appreciate your patience.

Thread Starter zantafio
(@zantafio)

2 days, 8 hours ago

@tahasin, thank you very much for your quick reply, and good luck!

NHWS
(@nhws)

2 days, 7 hours ago

Thanks @tahasin, Patchstack just mailed me the following:

Hey, it was marked as patched, we had issues with vendor communication, at first they missed our report due to issues with they web contact form, then they noticed disclosed vulnerability, asked us to provide details and again their form failed, so we were a bit disconnected from them.

Darius

Patchstack

Plugin Support Tahasin
(@tahasin)

2 days, 6 hours ago

Thanks for sharing Patchstack’s response @nhws .
Everything is okay now, and you can safely update the plugin to the latest version, 3.3.72.

NHWS
(@nhws)

7 hours, 38 minutes ago

yes, all good now. Thanks!

Viewing 10 replies - 1 through 10 (of 10 total)

You must be logged in to reply to this topic.