| Vulnerability Name: | CVE-2016-7982 (CCN-118140) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-10-12 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-10-12 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-05-24 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-22 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-7982 Source: CCN Type: Full-Disclosure Mailing List, Wed, 12 Oct 2016 15:29:15 +0200 CVE-2016-7982: SPIP 3.1.1/3.1.2 File Enumeration / Path Traversal Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20161005 SPIP vulnerabilities: request for 5 CVE Source: MLIST Type: Mailing List, Patch, Third Party Advisory [oss-security] 20161006 Re: SPIP vulnerabilities: request for 5 CVE Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20161012 CVE-2016-7982: SPIP 3.1.1/3.1.2 File Enumeration / Path Traversal Source: BID Type: Third Party Advisory, VDB Entry 93451 Source: CCN Type: BID-93451 SPIP Multiple Security Vulnerabilities Source: CCN Type: SPIP Web Site SPIP - Système de Publication pour Internet Source: CONFIRM Type: Issue Tracking, Patch, Vendor Advisory https://core.spip.net/projects/spip/repository/revisions/23200 Source: XF Type: UNKNOWN spip-cve20167982-dir-traversal(118140) Source: CCN Type: Packet Storm Security [10-20-2016] SPIP 3.1.2 File Enumeration / Path Traversal Source: MISC Type: UNKNOWN https://sysdream.com/news/lab/2016-10-19-spip-3-1-1-3-1-2-file-enumeration-path-traversal-cve-2016-7982/ Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [10-20-2016] | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||