CVE-2024-4836CWE-552

LFI in sites managed by Edito CMS

High · published July 2, 2024

CVSS v3.1
7.5
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user.

The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02629 · 85.4th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2024-07-02T08:44Z
EPSS history
Timeline
  • 02 JUL 08:44Z
    LFI in sites managed by Edito CMS
    cvelistv5