Lucene search

VulDBVULNRICHMENT:CVE-2024-8876

HistorySep 15, 2024 - 10:00 p.m.

CVE-2024-8876 xiaohe4966 TpMeCMS lang path traversal

2024-09-1522:00:09

CWE-22

VulDB

github.com

vulnerability

xiaohe4966 tpmecms

path traversal

remote attack

upgrade

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

26.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.3.2 is able to address this issue. It is recommended to upgrade the affected component.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:xiaohe4966:tpmecms:*:*:*:*:*:*:*:*"
    ],
    "vendor": "xiaohe4966",
    "product": "tpmecms",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.3.0",
        "versionType": "custom",
        "lessThanOrEqual": "1.3.3.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

vuldb.com/?ctiid.277508

vuldb.com/?id.277508

vuldb.com/?submit.404560

wiki.shikangsi.com/post/share/12da81ed-2dad-4a75-9b1a-db9afe1e7b7b

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

26.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-8876