CVE-2022-26159

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/p0dalirius/CVE-2022-26159-Ametys-Autocompletion-XML/	Exploit Third Party Advisory
https://issues.ametys.org/browse/CMS-10973	Issue Tracking Vendor Advisory
https://podalirius.net/en/cves/2022-26159/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ametys:ametys:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-02-28 04:15

Updated : 2023-08-08 14:22

NVD link : CVE-2022-26159

Mitre link : CVE-2022-26159

CVE.ORG link : CVE-2022-26159

JSON object : View

Products Affected

ametys

ametys

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2022-26159", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-02-28T04:15:07.123", "references": [{"url": "https://github.com/p0dalirius/CVE-2022-26159-Ametys-Autocompletion-XML/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://issues.ametys.org/browse/CMS-10973", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://podalirius.net/en/cves/2022-26159/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords."}, {"lang": "es", "value": "El plugin de autocompletado en Ametys CMS versiones anteriores a 4.5.0, permite a un atacante remoto no autenticado leer documentos como plugins/web/service/search/auto-completion/(domain)/en.xml (y nombres de ruta similares para otros idiomas), que contienen todos los caracteres escritos por todos los usuarios, incluyendo el contenido de las p\u00e1ginas privadas. Por ejemplo, una p\u00e1gina privada puede contener nombres de usuario, direcciones de correo electr\u00f3nico y posiblemente contrase\u00f1as."}], "lastModified": "2023-08-08T14:22:24.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ametys:ametys:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D9A5FB8-734F-47B0-9097-66BF65BA5733", "versionEndExcluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}