Description (CNA)
Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences. Attackers can manipulate the theme_name parameter in the themeexporthandle action or supply base64-encoded file paths to the downfile action to retrieve sensitive files outside intended directories.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Greencms / Green CMS | affected 2.0 |
CWE
CWE-22
References
- https://www.exploit-db.com/exploits/46245
- http://www.greencms.net/
- https://codeload.github.com/GreenCMS/GreenCMS/zip/beta
- https://www.vulncheck.com/advisories/green-cms-2-x-path-traversal-arbitrary-file-download
ADP enrichment
No English description supplied.
No references supplied.