PT-2010-3013 · Irmin Cms · Irmin Cms
Eidelweiss
·
Published
2010-04-08
·
Updated
2010-04-09
·
CVE-2010-1309
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Irmin CMS (formerly Pepsi CMS) version 0.6 BETA2
Description
A directory traversal issue allows remote attackers to read arbitrary files by using a .. (dot dot) in the
w parameter to the "index.php" endpoint.Recommendations
For Irmin CMS (formerly Pepsi CMS) version 0.6 BETA2, as a temporary workaround, consider restricting access to the
w parameter in the "index.php" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Irmin Cms