PT-2017-6267 · Getsimple · Getsimple Cms

Ross Marks · Published 2017-03-17 · Updated 2017-03-20 · CVE-2014-8723

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.4

Description The issue allows remote attackers to obtain sensitive information via a direct request to API endpoints such as "plugins/anonymous data.php" or "plugins/InnovationPlugin.php", which reveals the installation path in an error message.

Recommendations For GetSimple CMS version 3.3.4, consider restricting access to the "plugins/anonymous data.php" and "plugins/InnovationPlugin.php" files to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-8723

Affected Products

Getsimple Cms

References · 4

• 🔥 http://rossmarks.uk/whitepapers/getSimple_cms_3.3.4.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8723 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8723 · Note
• http://rossmarks.uk/portfolio.php · Note