vendor:
GreenCMS
by:
vr_system
7.5
CVSS
HIGH
Information Disclosure
200
CWE
Product Name: GreenCMS
Affected Version From: 2.3.0603
Affected Version To: 2.3.0603
Patch Exists: YES
Related CWE: CVE-2018-12604
CPE: a:greencms:greencms:2.3.0603
Metasploit:
N/A
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=154752, https://www.infosecmatter.com/nessus-plugin-library/?id=111223, https://www.infosecmatter.com/nessus-plugin-library/?id=105262, https://www.infosecmatter.com/nessus-plugin-library/?id=103575, https://www.infosecmatter.com/nessus-plugin-library/?id=45133, https://www.infosecmatter.com/nessus-plugin-library/?id=44095, https://www.infosecmatter.com/nessus-plugin-library/?id=45004, https://www.infosecmatter.com/nessus-plugin-library/?id=42052
Platforms Tested: Windows 7
2018
GreenCMS 2.3.0603 – remote obtain sensitive information
A vulnerability in GreenCMS 2.3.0603 allows an unauthenticated attacker to remotely obtain sensitive information. By sending a specially crafted request to the vulnerable server, an attacker can access the log file which contains sensitive information such as usernames and passwords.
Mitigation:
Upgrade to the latest version of GreenCMS.
