PT-2012-2006 · Impresspages · Impresspages Cms

Henri Salo · Publicado 2012-10-06 · Atualizado 2022-05-17 · CVE-2011-4932

Positive Technologies (AI Summary)

CVSS v4.0

8.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions ImpressPages CMS versions prior to 1.0.13

Description The issue allows remote attackers to execute arbitrary code via the cm group parameter in the ip cms/modules/standard/content management/actions.php file.

Recommendations For versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the actions.php file to minimize the risk of exploitation. Avoid using the cm group parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-4932

GHSA-FR34-MX6J-VPXH

Produtos afetados

Impresspages Cms

Referências · 14

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0029.html · Exploit
• https://github.com/impresspages/ImpressPages · Nota
• https://web.archive.org/web/20120726081336/http://impresspages.org/news/impresspages-1-0-13-security-release · Nota
• https://web.archive.org/web/20120726055617/http://securityfocus.com/bid/49798 · Nota
• http://secunia.com/advisories/46193 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/01/18/12 · Nota
• http://osvdb.org/75783 · Nota
• http://securityfocus.com/bid/49798 · Nota
• http://impresspages.org/news/impresspages-1-0-13-security-release · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4932 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fr34-mx6j-vpxh · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4932 · Nota
• http://seclists.org/bugtraq/2011/Sep/156 · Nota
• http://openwall.com/lists/oss-security/2012/01/15/9 · Nota