CVE-2018-20405

BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error

Low · published December 23, 2018

CVSS v3.1
2.7
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00822 · 56.9th percentile
Published
2018-12-23T23:00Z
EPSS history
Timeline
  • 23 DEC 23:00Z
    BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error
    cvelistv5