PT-2016-7723 · Exponent · Exponent Cms

Pang0Lin · Publicado 2016-11-11 · Atualizado 2017-07-28 · CVE-2016-9285

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0

Description The issue allows remote attackers to read user information by modifying the id number. This is related to an issue with "addresses, countries, and regions". An example of exploitation is via the endpoint "address/edit/id/1".

Recommendations For Exponent CMS version 2.4.0, consider restricting access to the address/edit/id/ endpoint until a patch is available. As a temporary workaround, avoid using the id parameter in the affected endpoint to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-9285

Produtos afetados

Exponent Cms

Referências · 6

• https://github.com/exponentcms/exponent-cms/commit/9eeed1e82fb9e6d0d41e7dd10672df48045a9b59 · Correção
• https://osv.dev/vulnerability/CVE-2016-9285 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9285 · Nota
• http://securitytracker.com/id/1037281 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9285 · Nota de Segurança
• http://securityfocus.com/bid/94296 · Nota