CVE-2014-8790
published 2015-01-20CVE-2014-8790: XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows…
PriorityP433medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.54%
83.0th percentile
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cagintranetworks | getsimple_cms | — | — |
| cagintranetworks | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
| get-simple | getsimple_cms | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://get-simple.info/start/changelog/http://karmainsecurity.com/KIS-2014-17http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Dec/135https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944http://get-simple.info/start/changelog/http://karmainsecurity.com/KIS-2014-17http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Dec/135https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944
2015-01-20
Published