PT-2019-9054

CVE-2018-14831

·

Publicado

2019-07-10

·

Atualizado

2019-07-17

Descrição por

CVSS 3.1
4.9
Média
MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0
Description The issue allows remote authenticated administrators to read any files on the server by crafting a specific URI, /admin.php?s=Tpl/Add/id/. This is an arbitrary file read vulnerability.
Recommendations For DamiCMS version 6.0.0, consider restricting access to the /admin.php?s=Tpl/Add/id/ endpoint until a patch is available. As a temporary workaround, limit the privileges of administrators to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Explorabilidade
Exploit
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Identificadores relacionados
CVE-2018-14831
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com