CVE-2018-10522

{"id": "CVE-2018-10522", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2018-04-27T18:29:00.697", "references": [{"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file view\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function."}, {"lang": "es", "value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"file view\" en el dashboard de administrador contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n sensible, explotable por los usuarios ordinarios, debido a que el producto expone un acceso no restringido a la funci\u00f3n file_get_contents de PHP."}], "lastModified": "2018-05-24T15:45:26.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C", "versionEndIncluding": "2.2.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}