PT-2016-7723 · Exponent · Exponent Cms

Pang0Lin · Published 2016-11-11 · Updated 2017-07-28 · CVE-2016-9285

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0

Description The issue allows remote attackers to read user information by modifying the id number. This is related to an issue with "addresses, countries, and regions". An example of exploitation is via the endpoint "address/edit/id/1".

Recommendations For Exponent CMS version 2.4.0, consider restricting access to the address/edit/id/ endpoint until a patch is available. As a temporary workaround, avoid using the id parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-9285

Affected Products

Exponent Cms

References · 6

• https://github.com/exponentcms/exponent-cms/commit/9eeed1e82fb9e6d0d41e7dd10672df48045a9b59 · Patch
• https://osv.dev/vulnerability/CVE-2016-9285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9285 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9285 · Note
• http://securitytracker.com/id/1037281 · Note
• http://securityfocus.com/bid/94296 · Note