CVE-2010-3468 Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809, and Sava CMS 5 through 5.2, allows remote attackers to read arbitrary files via a .. (dot d...
MediumCVSS 5.0
EPSS 6.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809, and Sava CMS 5 through 5.2, allows remote attackers to read arbitrary files via a .. (dot dot) in the FILEID parameter to the default URI under tasks/render/file/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| blueriver sava cms | = 5.0 | No fix listed |
| blueriver sava cms | = 5.0.122 | No fix listed |
| blueriver sava cms | = 5.2 | No fix listed |
| blueriver mura cms | = 5.1 | No fix listed |
| blueriver mura cms | = 5.2 | No fix listed |
References
- 41591 third-party-advisory vendor-advisory
- 15120 exploit
- www.getmura.com patch vendor-advisory
- 43499 vdb-entry
- www.stratsec.net exploit