PT-2017-6267 · Getsimple · Getsimple Cms

Ross Marks · Publicado 2017-03-17 · Atualizado 2017-03-20 · CVE-2014-8723

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.4

Description The issue allows remote attackers to obtain sensitive information via a direct request to API endpoints such as "plugins/anonymous data.php" or "plugins/InnovationPlugin.php", which reveals the installation path in an error message.

Recommendations For GetSimple CMS version 3.3.4, consider restricting access to the "plugins/anonymous data.php" and "plugins/InnovationPlugin.php" files to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-8723

Produtos afetados

Getsimple Cms

Referências · 4

• 🔥 http://rossmarks.uk/whitepapers/getSimple_cms_3.3.4.txt · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8723 · Nota
• http://rossmarks.uk/portfolio.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8723 · Nota de Segurança