PT-2019-7850 · Exponent · Exponent Cms

Peng Hua · Publicado 2019-05-24 · Atualizado 2019-05-28 · CVE-2016-8900

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9

Description The issue is related to an Object Injection vulnerability in the expTagController.php file, specifically in the change tags function. This vulnerability is located in the framework/modules/core/controllers directory of the Exponent CMS.

Recommendations For Exponent CMS version 2.3.9, consider disabling the change tags function in the expTagController.php file as a temporary workaround until a patch is available. Restrict access to the expTagController.php file to minimize the risk of exploitation.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2016-8900

Produtos afetados

Exponent Cms

Referências · 5

• 🔥 http://openwall.com/lists/oss-security/2016/09/30/5 · Exploit
• https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3db · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-8900 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8900 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8900 · Nota