PT-2016-7724 · Exponent · Exponent Cms

Pang0Lin · Publicado 2016-11-11 · Atualizado 2017-07-28 · CVE-2016-9286

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0patch1

Description The issue allows remote attackers to read address information due to improper access restriction to user records. This can be demonstrated by accessing the "address/show/id/1" URI.

Recommendations For Exponent CMS version 2.4.0patch1, consider restricting access to the address information by properly securing the usersController.php file in the framework/modules/users/controllers directory to prevent unauthorized reading of user records. As a temporary workaround, consider disabling the address/show/id API endpoint until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-9286

Produtos afetados

Exponent Cms

Referências · 6

• https://github.com/exponentcms/exponent-cms/commit/e38aae66c785f08f3907aa121378caf71ca5f2d7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9286 · Nota de Segurança
• http://securitytracker.com/id/1037281 · Nota
• https://osv.dev/vulnerability/CVE-2016-9286 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9286 · Nota
• http://securityfocus.com/bid/94296 · Nota