CVE-2014-8790

XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Dec/135	Exploit
http://karmainsecurity.com/KIS-2014-17	Exploit
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944
http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html	Exploit
http://get-simple.info/start/changelog/

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:get-simple:getsimple_cms:3.3.2:b3::::::
	cpe:2.3:a:get-simple:getsimple_cms:3.2:::::::*
	cpe:2.3:a:cagintranetworks:getsimple_cms:3.3.3:::::::*
	cpe:2.3:a:cagintranetworks:getsimple_cms:3.3.4:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.1.1:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.1.2:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.2.1:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.2.2:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.3.0:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.2.3:::::::*
	cpe:2.3:a:get-simple:getsimple_cms:3.3.1:::::::*

Information

Published : 2015-01-20 07:59

Updated : 2018-10-30 09:27

NVD link : CVE-2014-8790

Mitre link : CVE-2014-8790

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

cagintranetworks

getsimple_cms

get-simple

getsimple_cms

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://seclists.org/fulldisclosure/2014/Dec/135", "name": "20141231 [KIS-2014-17] GetSimple CMS <= 3.3.4 (api.php) XML External Entity Vulnerability", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "http://karmainsecurity.com/KIS-2014-17", "name": "http://karmainsecurity.com/KIS-2014-17", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944", "name": "https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944", "tags": [], "refsource": "CONFIRM"}, {"url": "http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html", "name": "http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://get-simple.info/start/changelog/", "name": "http://get-simple.info/start/changelog/", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-8790", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-01-20T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.3.2:b3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cagintranetworks:getsimple_cms:3.3.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cagintranetworks:getsimple_cms:3.3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:get-simple:getsimple_cms:3.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:27Z"}