PT-2022-17264 · Cuppacms · Cuppacms

Published 2022-02-23 · Updated 2022-03-03 · CVE-2022-25401

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cuppa CMS version 1.0

Description The issue allows attackers to gain read access to arbitrary files by copying any file to the current directory using the copy function of the file manager.

Recommendations For Cuppa CMS version 1.0, consider restricting access to the copy function of the file manager to prevent attackers from copying arbitrary files to the current directory. As a temporary workaround, consider disabling the copy function until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2022-25401

Affected Products

Cuppacms

References · 5

• 🔥❌ https://github.com/dota-st/Vulnerability/blob/master/CuppaCMS/CuppaCMS_second.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-25401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25401 · Security Note
• https://t.me/cibsecurity/38012 · Telegram Post
• https://t.me/cvenotify/27696 · Telegram Post