PT-2017-9225 · Exponent · Exponent Cms

Xiojunjie · Publicado 2017-02-13 · Atualizado 2018-02-27 · CVE-2016-7565

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9

Description The issue allows remote attackers to execute arbitrary commands. This is achieved by injecting shell metacharacters in the sc array parameter of the install/index.php file.

Recommendations For Exponent CMS version 2.3.9, consider restricting access to the install/index.php file until a patch is available. As a temporary workaround, avoid using the sc array parameter in the install/index.php file to minimize the risk of exploitation.

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-7565

Produtos afetados

Exponent Cms

Referências · 7

• https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0 · Nota
• https://github.com/exponentcms/exponent-cms/commit/4ae457ff1bf80e8b61286cd125ca794b25564e86 · Correção
• https://exponentcms.lighthouseapp.com/projects/61783/changesets/4ae457ff1bf80e8b61286cd125ca794b25564e86 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7565 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7565 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7565 · Nota
• http://openwall.com/lists/oss-security/2016/09/22/6 · Nota