Vulnerability Details CVE-2008-3924
The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover (1) account names and (2) password hashes via a direct request for (a) backup/cmme_data.zip or (b) backup/cmme_cmme.zip. NOTE: it was later reported that vector a also affects CMME 1.19.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.029
EPSS Ranking 85.7%
CVSS Severity
CVSS v2 Score 4.3
References
- http://secunia.com/advisories/31599
- http://securityreason.com/securityalert/4220
- http://www.securityfocus.com/bid/30854
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44684
- https://www.exploit-db.com/exploits/6313
- http://secunia.com/advisories/31599
- http://securityreason.com/securityalert/4220
- http://www.securityfocus.com/bid/30854
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44684
- https://www.exploit-db.com/exploits/6313
Products affected by CVE-2008-3924
-
cpe:2.3:a:hans_oesterholt:cmme:1.12