Vulnerability Details CVE-2014-9702
system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 56.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2014-9702
-
cpe:2.3:a:2pisoftware:cmfive:0.8.1
-
cpe:2.3:a:2pisoftware:cmfive:0.8.2
-
cpe:2.3:a:2pisoftware:cmfive:0.8.3
-
cpe:2.3:a:2pisoftware:cmfive:0.8.4
-
cpe:2.3:a:2pisoftware:cmfive:2015-03-15