PT-2012-2006 · Impresspages · Impresspages Cms

Henri Salo · Published 2012-10-06 · Updated 2022-05-17 · CVE-2011-4932

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions ImpressPages CMS versions prior to 1.0.13

Description The issue allows remote attackers to execute arbitrary code via the cm group parameter in the ip cms/modules/standard/content management/actions.php file.

Recommendations For versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the actions.php file to minimize the risk of exploitation. Avoid using the cm group parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-4932

GHSA-FR34-MX6J-VPXH

Affected Products

Impresspages Cms

References · 14

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0029.html · Exploit
• http://secunia.com/advisories/46193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4932 · Security Note
• https://osv.dev/vulnerability/GHSA-fr34-mx6j-vpxh · Vendor Advisory
• https://github.com/impresspages/ImpressPages · Note
• https://web.archive.org/web/20120726081336/http://impresspages.org/news/impresspages-1-0-13-security-release · Note
• https://web.archive.org/web/20120726055617/http://securityfocus.com/bid/49798 · Note
• http://openwall.com/lists/oss-security/2012/01/18/12 · Note
• http://osvdb.org/75783 · Note
• http://securityfocus.com/bid/49798 · Note
• http://impresspages.org/news/impresspages-1-0-13-security-release · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4932 · Note
• http://seclists.org/bugtraq/2011/Sep/156 · Note
• http://openwall.com/lists/oss-security/2012/01/15/9 · Note