Arbitrary File Download Vulnerability in GreenCMS by GreenCMS
CVE-2018-12988

7.5HIGH

Key Information:

Vendor

Greencms

Status
Greencms
Vendor
CVE Published:
29 June 2018

What is CVE-2018-12988?

GreenCMS version 2.3.0603 has an issue that allows unauthorized users to download arbitrary files through a specific URI endpoint. This vulnerability can be exploited to access sensitive files on the server, which may lead to further security breaches if not addressed promptly. Ensuring proper access controls and validations on file downloads is crucial to mitigate the risk posed by this vulnerability.

References

https://github.com/GreenCMS/GreenCMS/issues/111
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.