PT-2021-3961 · Fuel Cms · Fuel Cms

Bunneyops · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-38290

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 1.5.0

Description A host header attack issue exists due to the lack of special element neutralization in fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. An attacker can use a man-in-the-middle attack, such as phishing.

Recommendations For FUEL CMS version 1.5.0, consider disabling access to the fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php files until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php files in sensitive operations until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-04480

CVE-2021-38290

Affected Products

Fuel Cms

References · 7

• 🔥 https://github.com/daylightstudio/FUEL-CMS/issues/580 · Exploit
• https://github.com/daylightstudio/FUEL-CMS/commit/8a0d88ad6869623c90e24b3b2ea33352049d39a7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-38290 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38290 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04480 · Security Note
• https://t.me/cvenotify/18895 · Telegram Post
• https://t.me/cvenotify/19510 · Telegram Post