CVE-2016-9182

{"id": "CVE-2016-9182", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2016-11-04T10:59:01.333", "references": [{"url": "http://www.securityfocus.com/bid/94227", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/exponentcms/exponent-cms/commit/684d79424f768db8bb345d5c68aa2a886239492b", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized method name to bypass the permission check, e.g., controller=expHTMLEditor&action=preview&editor=ckeditor and controller=expHTMLEditor&action=Preview&editor=ckeditor. An anonymous user will be rejected for the former but can access the latter."}, {"lang": "es", "value": "Exponent CMS 2.4 utiliza reflexi\u00f3n PHP para llamar a un m\u00e9todo de una clase de controlador y luego utiliza el nombre del m\u00e9todo para comprobar el permiso de usuario. Pero el nombre del m\u00e9todo en una reflexi\u00f3n PHP es insensible a las may\u00fasculas y Exponent CMS permite acciones no definidas para ejecutar por defecto, de manera que un atacante puede utilizar nombre de m\u00e9todo capitalizado para eludir la verificaci\u00f3n de permiso, por ejemplo, controller=expHTMLEditor&action=preview&editor=ckeditor y controller=expHTMLEditor&action=Preview&editor=ckeditor. Un usuario an\u00f3nimo ser\u00e1 rechazado por el anterior pero puede acceder este \u00faltimo."}], "lastModified": "2016-11-29T18:37:37.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exponentcms:exponent_cms:2.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFEAA82F-83B2-49B8-B860-2F18C3C66321"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}