PT-2016-7724 · Exponent · Exponent Cms

Pang0Lin · Published 2016-11-11 · Updated 2017-07-28 · CVE-2016-9286

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0patch1

Description The issue allows remote attackers to read address information due to improper access restriction to user records. This can be demonstrated by accessing the "address/show/id/1" URI.

Recommendations For Exponent CMS version 2.4.0patch1, consider restricting access to the address information by properly securing the usersController.php file in the framework/modules/users/controllers directory to prevent unauthorized reading of user records. As a temporary workaround, consider disabling the address/show/id API endpoint until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-9286

Affected Products

Exponent Cms

References · 6

• https://github.com/exponentcms/exponent-cms/commit/e38aae66c785f08f3907aa121378caf71ca5f2d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9286 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9286 · Vendor Advisory
• http://securitytracker.com/id/1037281 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9286 · Note
• http://securityfocus.com/bid/94296 · Note