CVE-2019-7305CWE-200

eXtplorer exposes /usr and /etc/extplorer over HTTP

Medium · published April 9, 2020

CVSS v3.1
5.8
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this can lead to data leakage, information disclosure and potentially remote code execution on the web server. This issue affects all versions of eXtplorer in Ubuntu and Debian

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01833 · 78.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2020-04-09T23:50Z
EPSS history
Timeline
  • 09 APR 23:50Z
    eXtplorer exposes /usr and /etc/extplorer over HTTP
    cvelistv5