CVE-2022-2704

A vulnerability was found in SourceCodester Simple E-Learning System. It has been declared as problematic. This vulnerability affects unknown code of the file downloadFiles.php. The manipulation of the argument download leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205828.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vuls/vuls/blob/main/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download.md	Exploit Third Party Advisory
https://vuldb.com/?id.205828	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:simple_e-learning_system_project:simple_e-learning_system:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-08 13:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-2704

Mitre link : CVE-2022-2704

CVE.ORG link : CVE-2022-2704

JSON object : View

Products Affected

simple_e-learning_system_project

simple_e-learning_system

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2022-2704", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-08-08T13:15:08.587", "references": [{"url": "https://github.com/vuls/vuls/blob/main/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download/Simple%20E-Learning%20System%20downloadFiles.php%20Arbitrary%20File%20Download.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.205828", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester Simple E-Learning System. It has been declared as problematic. This vulnerability affects unknown code of the file downloadFiles.php. The manipulation of the argument download leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205828."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en SourceCodester Simple E-Learning System. Ha sido declarada como problem\u00e1tica. Esta vulnerabilidad afecta a c\u00f3digo desconocido del archivo downloadFiles.php. La manipulaci\u00f3n del argumento download conlleva la divulgaci\u00f3n de informaci\u00f3n. El ataque puede ser iniciado remotamente. La explotaci\u00f3n ha sido divulgada al p\u00fablico y puede ser usada. El identificador de esta vulnerabilidad es VDB-205828"}], "lastModified": "2022-08-11T17:59:27.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:simple_e-learning_system_project:simple_e-learning_system:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63434745-AE99-457F-A3C1-C02499429E3F"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}