Lucene search

MitreCVE-2016-9285

HistoryNov 11, 2016 - 10:59 p.m.

CVE-2016-9285

2016-11-1122:59:03

CWE-200

mitre

web.nvd.nist.gov

exponent cms

v2.4.0

addresscontroller.php

remote attackers

user information

security issue

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

59.5%

JSON

framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an “addresses, countries, and regions” issue.

Affected configurations

Nvd

Node

exponentcmsexponent_cmsMatch2.4.0

VendorProductVersionCPE
exponentcmsexponent_cms2.4.0cpe:/a:exponentcms:exponent_cms:2.4.0:::

Vendor	Product	Version	CPE
exponentcms	exponent_cms	2.4.0	cpe:/a:exponentcms:exponent_cms:2.4.0:::

References

www.securityfocus.com/bid/94296

www.securitytracker.com/id/1037281

github.com/exponentcms/exponent-cms/commit/9eeed1e82fb9e6d0d41e7dd10672df48045a9b59

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

59.5%

JSON

Related for CVE-2016-9285