CVE-2014-8790: Medium severity getsimple cms vulnerability
Published Jan 20, 2015
·Updated
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
Affected Software
11 affected components
Cagintranetworks Getsimple Cms=3.3.3
Cagintranetworks Getsimple Cms=3.3.4
Get-simple Getsimple Cms=3.1.1
Get-simple Getsimple Cms=3.1.2
Get-simple Getsimple Cms=3.2
Get-simple Getsimple Cms=3.2.1
Get-simple Getsimple Cms=3.2.2
Get-simple Getsimple Cms=3.2.3
Get-simple Getsimple Cms=3.3.0
Get-simple Getsimple Cms=3.3.1
Get-simple Getsimple Cms=3.3.2-b3
Event History
Jan 20, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8790?
CVE-2014-8790 is classified as a medium severity vulnerability due to the potential for unauthorized file access.
2
How do I fix CVE-2014-8790?
To fix CVE-2014-8790, you should upgrade GetSimple CMS to version 3.3.5 Beta 1 or later.
3
Which versions of GetSimple CMS are affected by CVE-2014-8790?
CVE-2014-8790 affects GetSimple CMS versions 3.1.1 through 3.3.x before 3.3.5 Beta 1.
4
What type of vulnerability is CVE-2014-8790?
CVE-2014-8790 is an XML external entity (XXE) vulnerability.
5
Can CVE-2014-8790 allow remote attackers access to sensitive information?
Yes, CVE-2014-8790 can allow remote attackers to read arbitrary files, potentially exposing sensitive information.