Object Injection Vulnerability in Exponent CMS by Exponent
CVE-2016-8900

9.8CRITICAL

Key Information:

Vendor

Exponentcms

Status
Exponent Cms
Vendor
CVE Published:
24 May 2019

What is CVE-2016-8900?

Exponent CMS version 2.3.9 contains an object injection vulnerability in the expTagController.php file within the core module framework. This flaw arises during the handling of the change_tags functionality, potentially allowing an attacker to manipulate the application state and execute arbitrary code. Proper sanitization and validation measures must be implemented to mitigate this risk effectively.

References

http://www.openwall.com/lists/oss-security/2016/09/30/5
x_refsource_MISC
https://github.com/exponentcms/exponent-cms/commit/fdafb5...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.