PT-2022-11649 · Cmseasy · Cmseasy

Jdr · Published 2022-05-17 · Updated 2022-05-26 · CVE-2021-42644

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cmseasy version 7.7.5 20211012

Description The issue allows for an arbitrary file read after login, potentially exposing configuration file information of the website, including the database configuration file located in config / config database.

Recommendations For cmseasy version 7.7.5 20211012, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2021-42644

Affected Products

Cmseasy

References · 5

• 🔥 https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E · Exploit
• https://osv.dev/vulnerability/CVE-2021-42644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42644 · Security Note
• https://t.me/cvenotify/30304 · Telegram Post
• https://t.me/cibsecurity/42805 · Telegram Post