Lucene search
HistorySep 13, 2022 - 11:15 p.m.
CVE-2022-37191
cuppacms v1.0
component
lfi vulnerability
authenticated user
crafted post request.
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.252 Low
EPSS
Percentile
96.7%
The component “cuppa/api/index.php” of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.
Affected configurations
Node
cuppacmscuppacmsMatch1.0
Related
cve
cve
CVE-2022-37191
2022-09-13 23:15:08
prion
prion
Cross site request forgery (csrf)
2022-09-13 23:15:00
nuclei
nuclei
Cuppa CMS v1.0 - Authenticated Local File Inclusion
2023-04-21 08:56:01
cvelist
cvelist
CVE-2022-37191
2022-09-13 22:07:19
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.252 Low
EPSS
Percentile
96.7%
Related for NVD:CVE-2022-37191