PT-2016-7682 · Ckeditor+2 · Ckeditor+2

Fyth · Published 2016-11-04 · Updated 2016-11-29 · CVE-2016-9182

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4

Description The issue arises from the use of PHP reflection in Exponent CMS to call a method of a controller class, which is case insensitive. This, combined with the default permission to execute undefined actions, allows an attacker to bypass the permission check by using a capitalized method name. For example, an attacker can access a restricted area by using a capitalized method name, such as controller=expHTMLEditor&action=Preview&editor=ckeditor, whereas the same action with a lowercase method name, controller=expHTMLEditor&action=preview&editor=ckeditor, would be rejected for an anonymous user.

Recommendations For Exponent CMS version 2.4, consider disabling the execution of undefined actions by default to minimize the risk of exploitation. Additionally, restrict access to sensitive controller methods to prevent unauthorized access. As a temporary workaround, consider implementing case-sensitive permission checks for controller methods until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9182

Affected Products

Exponent Cms

Php

Ckeditor

References · 5

• https://github.com/exponentcms/exponent-cms/commit/684d79424f768db8bb345d5c68aa2a886239492b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9182 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9182 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9182 · Note
• http://securityfocus.com/bid/94227 · Note