[email protected]CVE-2014-8790

HistoryJan 20, 2015 - 3:59 p.m.

CVE-2014-8790

2015-01-2015:59:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2014-8790

xxe vulnerability

xml

getsimple cms

remote attack

arbitrary file read

nvd

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

77.9%

JSON

XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.

CPENameOperatorVersion
cagintranetworks:getsimple_cmscagintranetworks getsimple cmseq3.3.3
cagintranetworks:getsimple_cmscagintranetworks getsimple cmseq3.3.4
get-simple:getsimple_cmsget-simple getsimple cmseq3.1.1
get-simple:getsimple_cmsget-simple getsimple cmseq3.1.2
get-simple:getsimple_cmsget-simple getsimple cmseq3.2
get-simple:getsimple_cmsget-simple getsimple cmseq3.2.1
get-simple:getsimple_cmsget-simple getsimple cmseq3.2.2
get-simple:getsimple_cmsget-simple getsimple cmseq3.2.3
get-simple:getsimple_cmsget-simple getsimple cmseq3.3.0
get-simple:getsimple_cmsget-simple getsimple cmseq3.3.1

CPE	Name	Operator	Version
cagintranetworks:getsimple_cms	cagintranetworks getsimple cms	eq	3.3.3
cagintranetworks:getsimple_cms	cagintranetworks getsimple cms	eq	3.3.4
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.1.1
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.1.2
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.2
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.2.1
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.2.2
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.2.3
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.3.0
get-simple:getsimple_cms	get-simple getsimple cms	eq	3.3.1

Rows per page:

1-10 of 111

References

get-simple.info/start/changelog/

karmainsecurity.com/KIS-2014-17

packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html

seclists.org/fulldisclosure/2014/Dec/135

github.com/GetSimpleCMS/GetSimpleCMS/issues/944

6.9 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

77.9%

JSON

Related for CVE-2014-8790

packetstorm1 cvelist1 prion1 zdt1