Lucene search
HistoryNov 17, 2012 - 9:55 p.m.
CVE-2012-5892
cve-2012-5892
havalite cms
information disclosure
remote attack
access control
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
76.6%
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.
Affected configurations
Node
havalitecmsRange≤1.1.0
| CPE | Name | Operator | Version |
|---|---|---|---|
| havalite:cms | havalite cms | le | 1.1.0 |
Related
cvelist
cvelist
CVE-2012-5892
2012-11-17 21:00:00
nvd
nvd
CVE-2012-5892
2012-11-17 21:55:03
prion
prion
Improper access control
2012-11-17 21:55:00
packetstorm
packetstorm
Havalite 1.1.7 Cross Site Scripting / Shell Upload
2012-12-10 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
76.6%
Related for CVE-2012-5892