CVE-2018-9126

Опубликовано: 04 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 5

EPSS Высокий

Описание

The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.

Ссылки

http://packetstormsecurity.com/files/146999/DotNetNuke-DNNarticle-Directory-Traversal.html
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44414/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/146999/DotNetNuke-DNNarticle-Directory-Traversal.html
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44414/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zldnn:dnnarticle:11:*:*:*:*:dnn:*:*

EPSS

Процентиль: 99%

0.82216

Высокий

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-7jcf-pp7q-q98w