PT-2016-7682 · Ckeditor+2 · Ckeditor+2

Fyth · Publicado 2016-11-04 · Atualizado 2016-11-29 · CVE-2016-9182

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4

Description The issue arises from the use of PHP reflection in Exponent CMS to call a method of a controller class, which is case insensitive. This, combined with the default permission to execute undefined actions, allows an attacker to bypass the permission check by using a capitalized method name. For example, an attacker can access a restricted area by using a capitalized method name, such as controller=expHTMLEditor&action=Preview&editor=ckeditor, whereas the same action with a lowercase method name, controller=expHTMLEditor&action=preview&editor=ckeditor, would be rejected for an anonymous user.

Recommendations For Exponent CMS version 2.4, consider disabling the execution of undefined actions by default to minimize the risk of exploitation. Additionally, restrict access to sensitive controller methods to prevent unauthorized access. As a temporary workaround, consider implementing case-sensitive permission checks for controller methods until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9182

Produtos afetados

Exponent Cms

Php

Ckeditor

Referências · 5

• https://github.com/exponentcms/exponent-cms/commit/684d79424f768db8bb345d5c68aa2a886239492b · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9182 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9182 · Nota
• https://osv.dev/vulnerability/CVE-2016-9182 · Aviso do Fabricante
• http://securityfocus.com/bid/94227 · Nota