CVE-2022-37191 - The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI

Back Back to CVE browser

MEDIUM

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI

Published Sep 13, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 3.58%

Description

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-829

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39843
Advisory
https://github.com/CuppaCMS/CuppaCMS/issues/20
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/badru8612/CuppaCMS-Authenticated-LFI-Vulnerability
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39843		Advisory
https://github.com/CuppaCMS/CuppaCMS/issues/20		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/badru8612/CuppaCMS-Authenticated-LFI-Vulnerability		x_refsource_MISCExploitThird Party Advisory