CVE-2014-8722: Infoleak

Published Mar 17, 2017

Updated

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.

Affected Software

1 affected component

Get-simple Getsimple Cms=3.3.4

Event History

Mar 17, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8722?

CVE-2014-8722 is classified as having a moderate severity level due to its potential for sensitive information disclosure.

How do I fix CVE-2014-8722?

To mitigate CVE-2014-8722, it's recommended to ensure that sensitive files are not publicly accessible or to upgrade to a patched version of GetSimple CMS.

What type of information can be exposed by CVE-2014-8722?

CVE-2014-8722 allows remote attackers to access sensitive user data stored in XML files.

Which version of GetSimple CMS is affected by CVE-2014-8722?

CVE-2014-8722 specifically affects GetSimple CMS version 3.3.4.

Can CVE-2014-8722 be exploited remotely?

Yes, CVE-2014-8722 can be exploited by remote attackers to directly request and obtain sensitive XML files.