PT-2019-7850 · Exponent · Exponent Cms

Peng Hua · Published 2019-05-24 · Updated 2019-05-28 · CVE-2016-8900

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9

Description The issue is related to an Object Injection vulnerability in the expTagController.php file, specifically in the change tags function. This vulnerability is located in the framework/modules/core/controllers directory of the Exponent CMS.

Recommendations For Exponent CMS version 2.3.9, consider disabling the change tags function in the expTagController.php file as a temporary workaround until a patch is available. Restrict access to the expTagController.php file to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2016-8900

Affected Products

Exponent Cms

References · 5

• 🔥 http://openwall.com/lists/oss-security/2016/09/30/5 · Exploit
• https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3db · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-8900 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8900 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8900 · Note